AI-Assisted Secure Coding (Appendix C) · CI/CD Pipeline Hardening Specific to AI Augmentation
Stream pipeline logs to security monitoring
Verify that pipeline audit logs (workflow runs, secret access, runner registration, permission grants, OIDC token issuance) are streamed in real time to centralized security monitoring. Detection rules are tuned for AI-augmented threat patterns: bulk PR creation from new accounts, workflow-file modifications in fork PRs, unexpected secret access from AI-runner pools, and unusual egress (webhooks, paste sites, bin services) from AI workloads.
OWASP AISVS v1.01, requirement AC.12.6
In plain English
Stream pipeline audit logs to security monitoring in real time, with rules for AI-related threats such as bulk PRs from new accounts, workflow edits in fork PRs, unexpected secret access and unusual outbound traffic from AI workloads.
What good looks like
- Pipeline audit logs reach monitoring in real time.
- Rules cover the listed patterns.
- Alerts are triaged.
How teams usually do it
- Audit log streaming from your CI platform to your SIEM.
Evidence an auditor would accept
- Streaming configuration and rules.
Common mistakes
- Downloading audit logs only during incidents.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.