How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · CI/CD Pipeline Hardening Specific to AI Augmentation
Re-check open PRs after a workflow fix
Verify that the remediation of a vulnerable workflow includes invalidating or re-validating any PR that was opened before the fix landed. Without this step, a later commit to the same PR can pick up the stale workflow definition and route around the fix.
OWASP AISVS v1.01, requirement AC.12.8
In plain English
When you fix a vulnerable workflow, invalidate or re-check pull requests opened before the fix, since a later commit to an old PR can still use the old workflow.
What good looks like
- Open PRs are reviewed after workflow fixes.
- Old PRs are closed or re-run under the new workflow.
- The step is part of the remediation checklist.
How teams usually do it
- A script that lists open PRs older than the fix and re-triggers or closes them.
Evidence an auditor would accept
- The remediation checklist and a past example.
Common mistakes
- Fixing the workflow file and assuming the problem is over.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.