AI-Assisted Secure Coding (Appendix C) · CI/CD Pipeline Hardening Specific to AI Augmentation
Don't leave credentials in untrusted workspaces
Verify that secrets, credentials, and pipeline job tokens are not persisted into workspaces that process AI-touched or fork-originated untrusted code. For example, set `persist-credentials: false` on checkout where the platform supports it, and scrub CI runners of cached credentials before AI tooling runs.
OWASP AISVS v1.01, requirement AC.12.2
In plain English
Do not leave secrets, credentials or job tokens in workspaces that process AI-touched or fork-originated code. Whatever is on disk or in the git configuration, the untrusted code or an injected agent can read it.
What good looks like
- Checkout steps do not persist credentials into the workspace.
- Runners are cleared of cached credentials before AI tooling runs.
- Secrets are passed only to the specific steps that need them.
- A test job has searched the workspace for leftover tokens and found none.
How teams usually do it
- Setting persist-credentials: false on the checkout action, or the equivalent on other platforms.
- Fresh, ephemeral runners so nothing carries over (AC.12.4).
- Scoping secrets to individual steps, never to the whole job's environment.
Suggested evidence
- Workflow configuration.
- Results of a workspace scan for credentials.
Common mistakes
- Default checkout settings that leave the token in the local git configuration.
- Job-level environment variables holding secrets that every step, including the AI tool, can read.
- Credential helper caches and cloud CLI config directories left on a reused runner.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.