AI-Assisted Secure Coding (Appendix C) · Secure Prompt & Context Management
Reject oversized repository input
Verify that input length controls stop untrusted PR or repository content from crowding system instructions or safety directives out of the effective context window. Oversized inputs are rejected outright. Silent truncation is not acceptable.
OWASP AISVS v1.01, requirement AC.3.5
In plain English
Limit how much untrusted repository or PR content can go into the context, so it cannot crowd out your instructions. Reject oversized input outright. Silent truncation is not acceptable, because the part that gets cut may be your own rules.
What good looks like
- Token limits apply to untrusted content, per source and in total.
- Oversized input is rejected with a clear message and a log entry.
- System instructions and safety directives are always included in full.
- The limits are tested with very large diffs, files and comment threads.
How teams usually do it
- Token counting in the bot or integration before the prompt is built.
- For large PRs, splitting the review into several bounded passes or asking for a smaller PR.
- Fixed reserved space for instructions and for the response.
Suggested evidence
- Limit configuration.
- Tests with oversized PRs showing rejection.
Common mistakes
- Truncating long diffs silently, so the review covers half the change and reports success.
- Counting characters when the limit that matters is in tokens.
- Letting a generated file or lockfile fill the budget so the real change is never read.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.