AI-Assisted Secure Coding (Appendix C) · Validation of AI-Generated Code
Block merges on critical findings
Verify that pull requests containing AI-generated code are blocked from merging when an automated scan surfaces a critical security finding, defined as CVSS >= 9.0 or the equivalent threshold in the organization's vulnerability severity policy. Bypassing the block requires a written exception approved by an authorized human.
OWASP AISVS v1.01, requirement AC.4.3
In plain English
Block merging when a scan finds a critical issue (CVSS 9.0 or above, or your own equivalent). Overriding the block needs written approval from an authorised person.
What good looks like
- Critical findings block merges.
- Exceptions need recorded approval.
- Exceptions are reviewed regularly.
How teams usually do it
- Required status checks tied to scanner severity.
Evidence an auditor would accept
- Branch protection settings and exception records.
Common mistakes
- Making the check optional so it can be ignored under pressure.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.