AI-Assisted Secure Coding (Appendix C) · Compromise Containment & Automated Remediation
Rotate secrets after a suspicious run
Verify that any secret that touched a workflow run associated with a suspicious PR, a prompt-injection event, or an AI-agent anomaly, or that is found in an agent session record, is automatically rotated, and that downstream issuers (cloud IAM, package registries, signing-key custodians) are notified of the rotation.
OWASP AISVS v1.01, requirement AC.14.2
In plain English
Automatically rotate any secret that touched a suspicious workflow run, an injection event or an agent anomaly, or that turns up in an agent session record, and notify the systems that issued it.
What good looks like
- Rotation is automatic for these triggers.
- Issuers such as cloud IAM, package registries and signing services are notified.
- Rotations are logged.
How teams usually do it
- Secrets manager rotation triggered by security alerts.
Evidence an auditor would accept
- Automation configuration and rotation logs.
Common mistakes
- Rotating the obvious secret and missing others the run could read.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.