AI-Assisted Secure Coding (Appendix C) · Secure Prompt & Context Management
Screen repository content for injection
Verify that any externally sourced context being fed to an AI tool is treated as untrusted and screened for prompt injection before it reaches the prompt. Sources to cover: PR descriptions and comments, fork-supplied diffs, issue bodies, commit messages, third-party documentation, web search results, and MCP tool outputs.
OWASP AISVS v1.01, requirement AC.3.3
In plain English
Anything from outside your team that is fed to an AI tool can carry instructions for it. Treat that content as untrusted and screen it for prompt injection before it reaches the prompt. The sources include PR descriptions and comments, diffs from forks, issue text, commit messages, third-party documentation, web search results and MCP tool output.
What good looks like
- Every external source the tool reads is listed.
- Each is screened before its content reaches the prompt.
- Flagged content is blocked or clearly marked as untrusted.
- Screening covers hidden content: HTML comments, invisible characters and text in images.
How teams usually do it
- The injection detection described in 2.1.3, applied inside the bot or assistant integration.
- Stripping HTML comments and invisible Unicode from PR and issue text before the model sees it.
- Limiting which authors' content the tool will process without a maintainer's approval.
Suggested evidence
- Configuration listing sources and screening.
- Test results with poisoned PR, issue and commit content.
Common mistakes
- Screening issue text and skipping commit messages, file contents or dependency READMEs.
- Trusting content because it sits in your own repository, when an outside contributor wrote it.
- Relying on screening alone for a tool that has write access (see AC.11.4).
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.