AI-Assisted Secure Coding (Appendix C) · AI Code-Review & Assistant Bot Hardening
Review bots treat PR content as untrusted
Verify that AI review and assistant bots treat every piece of PR-supplied content (diff, title, description, comments, file contents, commit messages, linked external URLs) as untrusted input, and apply the AISVS C2.1 prompt-injection defenses: instruction-hierarchy enforcement, content sanitization, and indirect-injection detection.
OWASP AISVS v1.01, requirement AC.11.1
In plain English
An AI review or assistant bot must treat everything in a pull request as untrusted: the diff, title, description, comments, file contents, commit messages and linked URLs. Any of them can carry instructions aimed at the bot. Apply the prompt injection defences from chapter 2 to all of it.
What good looks like
- All PR-supplied content is presented to the model as untrusted data.
- The instruction hierarchy is enforced, so the bot's instructions beat anything in the PR.
- Content is sanitised (hidden text, HTML comments and invisible characters removed) and screened for indirect injection.
- Linked URLs are not fetched, or are fetched through the same screening.
How teams usually do it
- The controls in section 2.1 (normalisation, injection screening, instruction hierarchy) applied inside the bot integration.
- Delimiting and labelling each piece of PR content by source in the prompt.
- Choosing bots whose vendors document these defences, and testing them yourself (AC.2.3).
Suggested evidence
- Bot configuration.
- Injection test results using each PR surface.
Common mistakes
- Treating text in the diff as safe because it is "just code". Comments and strings in code are read by the model like any other text.
- Screening the description and ignoring commit messages and file names.
- Letting the bot follow links in the PR.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.