AI-Assisted Secure Coding (Appendix C) · CI/CD Pipeline Hardening Specific to AI Augmentation
Treat artifacts from untrusted PRs as data
Verify that artifacts produced by untrusted PR workflows are treated as untrusted passive data when a privileged follow-up workflow consumes them. The privileged workflow never executes binaries, scripts, packages, caches, or generated workflow fragments that originated in an untrusted contribution.
OWASP AISVS v1.01, requirement AC.12.7
In plain English
When a privileged workflow uses artifacts from an untrusted PR workflow, treat them as passive data. It must never run binaries, scripts, packages, caches or workflow fragments that came from the untrusted contribution.
What good looks like
- Artifacts from untrusted workflows are read as data only.
- Nothing from them is executed.
- Their format is validated.
How teams usually do it
- Passing only plain data files such as JSON, validated before use.
Evidence an auditor would accept
- Workflow review notes.
Common mistakes
- Restoring a build cache produced by a fork PR.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.