AI-Assisted Secure Coding (Appendix C) · CI/CD Pipeline Hardening Specific to AI Augmentation
Treat artifacts from untrusted PRs as data
Verify that artifacts produced by untrusted PR workflows are treated as untrusted passive data when a privileged follow-up workflow consumes them. The privileged workflow never executes binaries, scripts, packages, caches, or generated workflow fragments that originated in an untrusted contribution.
OWASP AISVS v1.01, requirement AC.12.7
In plain English
When a privileged workflow uses artifacts produced by an untrusted PR workflow, it must treat them as passive data. It must never execute binaries, scripts, packages, caches or workflow fragments that came from the untrusted contribution. Otherwise the split in AC.12.1 achieves nothing.
What good looks like
- Artifacts from untrusted workflows are read as data only.
- Nothing from them is executed, installed, sourced or restored as a cache.
- Their format and content are validated before use.
- They are unpacked to a separate directory and cannot overwrite workspace files.
How teams usually do it
- Passing only simple data files (for example JSON with a fixed schema or a PR number) and validating them strictly.
- Extracting artifacts to a temporary directory, with path checks against traversal.
- Separate cache scopes, so privileged workflows never restore caches written by fork PRs.
Suggested evidence
- Workflow review notes showing how artifacts are consumed.
- Validation code.
Common mistakes
- Restoring a build cache produced by a fork PR.
- Unpacking an artifact over the workspace, where it replaces a script the privileged workflow then runs.
- Treating a coverage or test report as safe and passing its contents into a shell command or a prompt.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.