AI-Assisted Secure Coding (Appendix C) · AI Code-Review & Assistant Bot Hardening
Lock review bot prompts and policy
Verify that AI review and assistant bot system prompts and policy configurations are integrity-checked at load time (signed, hash-pinned), and that nothing in the repository, in branch contents, in PR-sourced environment variables, or in any other user-controllable input can modify them.
OWASP AISVS v1.01, requirement AC.11.2
In plain English
A bot's system prompt and policy configuration define what it will and will not do. Check their integrity when they load, and make sure nothing a contributor controls can change them. That rules out the repository's own files, branch contents and environment variables set from the PR.
What good looks like
- System prompts and policy files are signed or pinned by hash, and checked at load time.
- They load from a location contributors cannot write to.
- A failed integrity check stops the bot.
- No PR-controlled input (branch files, PR-sourced environment variables, labels, comments) can alter them.
How teams usually do it
- Bot configuration kept in a separate, protected repository or the vendor's organisation-level settings, referenced by a pinned commit hash.
- Loading configuration from the base branch, never from the PR head.
- A hash check at start-up, with an alert on mismatch.
Suggested evidence
- The configuration location and its access controls.
- The integrity check and a test where a modified prompt stops the bot.
Common mistakes
- Reading bot instructions from a file in the PR branch, so the PR can rewrite the reviewer's rules.
- Per-repository instruction files that any contributor can change in the same PR being reviewed.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.