How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Adversarial AI Detection in Inbound Contributions
Approve first-time contributors' PRs
Verify that PRs from first-time or low-reputation contributors require maintainer approval before any privileged workflow processes them. Privileged workflows here include AI review bots, secret-bearing jobs, and external-integration calls.
OWASP AISVS v1.01, requirement AC.13.2
In plain English
PRs from first-time or low-reputation contributors need a maintainer's approval before any privileged workflow, AI review bot or external integration processes them.
What good looks like
- Approval is required for these contributors.
- Privileged processing waits for it.
- Approvals are logged.
How teams usually do it
- CI platform settings requiring approval for first-time contributors.
Evidence an auditor would accept
- Repository settings.
Common mistakes
- Approving every first-time PR without reading it.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.