AI-Assisted Secure Coding (Appendix C) · Adversarial AI Detection in Inbound Contributions
Flag unusual contribution patterns
Verify that contribution-velocity and contributor-reputation analytics flag anomalies: bulk PR creation from newly created accounts, coordinated fork waves immediately preceding PRs, PR volumes that are inconsistent with human authorship, and reuse of payload patterns across unrelated repositories.
OWASP AISVS v1.01, requirement AC.13.1
In plain English
AI lets one attacker open hundreds of plausible pull requests. Watch contribution patterns and flag the unusual: many PRs from newly created accounts, waves of forks just before PRs arrive, volumes no person could produce, and the same payload appearing across unrelated repositories.
What good looks like
- Contribution velocity and contributor reputation are analysed continuously.
- Each of the four anomaly types in the requirement raises a flag.
- Flags are reviewed by maintainers or security.
- Thresholds are tuned to your project's normal activity.
How teams usually do it
- Analytics over repository events from the platform API or audit log, with simple rules: account age, PR rate, fork-then-PR timing, and similarity of diffs.
- Sharing indicators across your repositories, so a payload seen in one is recognised in another.
- Platform features that limit interactions from new accounts during a suspected campaign.
Suggested evidence
- The rules and thresholds.
- Recent flags and what was done.
Common mistakes
- Noticing a campaign only after something merged.
- Per-repository analysis that cannot see a pattern spread over many repositories.
- Thresholds that flag every new contributor and discourage real ones.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.