How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Secure Prompt & Context Management
No secrets in prompts
Verify that written guidance forbids putting secrets, credentials, PII, or classified data in any prompt sent to an AI tool. The guidance is enforced in pre-commit hooks, IDE integrations, and CI.
OWASP AISVS v1.01, requirement AC.3.1
In plain English
Forbid putting secrets, credentials, personal data or classified data into prompts for AI tools, and back the rule with hooks and scanners that catch violations.
What good looks like
- The rule is written down.
- Pre-commit hooks, IDE plugins or CI checks catch violations.
- Violations are logged and followed up.
How teams usually do it
- Secret scanning in pre-commit and CI, plus IDE settings that exclude sensitive files from AI context.
Evidence an auditor would accept
- The rule and the enforcing configurations.
Common mistakes
- A written rule with nothing that enforces it.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.