AI-Assisted Secure Coding (Appendix C) · AI Code-Review & Assistant Bot Hardening
Read-only mode for untrusted fork PRs
Verify that AI review bots run in a zero-privilege, read-only shadow mode for untrusted fork PRs. In shadow mode, inline code-generation commentary is restricted and privileged workflow interaction is forbidden, until a repository maintainer has cleared an initial first-time-contributor verification gate.
OWASP AISVS v1.01, requirement AC.11.7
In plain English
For pull requests from untrusted forks, run review bots in a read-only shadow mode with no privileges, until a maintainer has cleared the first-time contributor. A fork PR is content written entirely by a stranger and aimed straight at your bot.
What good looks like
- Fork PRs from unverified contributors put the bot in read-only mode.
- In that mode the bot's inline code-generation commentary is restricted, and it cannot interact with privileged workflows.
- A maintainer's explicit action lifts the restriction.
- The mode is enforced by the platform and token permissions, and the bot does not decide it.
How teams usually do it
- Separate workflow paths for fork PRs, with a read-only token and no secrets.
- The platform's first-time contributor approval setting as the gate (see AC.13.2).
- Bot output for unverified forks posted as a summary for maintainers only, or held.
Suggested evidence
- Workflow configuration for fork PRs.
- Token permissions in shadow mode.
- A test fork PR showing restricted behaviour.
Common mistakes
- A bot that answers a fork PR with suggested code or comments containing data from the base repository.
- Treating a contributor as trusted because one trivial PR of theirs was merged earlier.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.