How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Secure Prompt & Context Management
Strip sensitive data from context
Verify that technical controls automatically strip sensitive material from any context window sent to an AI tool. Client-side redaction, approved context filters, and secret scanners with pre-prompt hooks all qualify.
OWASP AISVS v1.01, requirement AC.3.2
In plain English
Strip sensitive material from context automatically before it is sent to an AI tool.
What good looks like
- Redaction runs before context leaves the developer's machine or your network.
- It covers secrets and personal data.
- Redaction is tested.
How teams usually do it
- Context filters in the AI tool configuration, client-side redaction and secret scanners in pre-prompt hooks.
Evidence an auditor would accept
- Filter configuration and test results.
Common mistakes
- Excluding .env files but not test fixtures that contain real data.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.