AI-Assisted Secure Coding (Appendix C) · Continuous Feedback, Adversarial Testing & Model Fine-Tuning
Feed flags back into the tooling
Verify that aggregated feedback feeds into periodic system-prompt updates or retrieval-augmented generation against vetted secure-coding corpora (OWASP Cheat Sheets, internal coding standards). Where the organization controls model training infrastructure, fine-tuning on the same feedback corpus is also required.
OWASP AISVS v1.01, requirement AC.6.2
In plain English
Use collected feedback to improve the tools, through system prompt updates or retrieval of approved secure-coding guidance, and through fine-tuning if you control training.
What good looks like
- Feedback is reviewed on a schedule.
- System prompts or retrieval sources are updated from it.
- Changes are tested before release.
How teams usually do it
- Retrieval over OWASP Cheat Sheets and internal standards, updated from feedback themes.
Evidence an auditor would accept
- Change history for prompts and sources.
Common mistakes
- Collecting feedback with no route back into the tools.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.