AI-Assisted Secure Coding (Appendix C) · Secure Prompt & Context Management
Scan agent session records for credentials
Verify that on-disk session records produced by approved AI coding agents are scanned for credential material on a defined schedule shorter than the record retention period.
OWASP AISVS v1.01, requirement AC.3.7
In plain English
AI coding agents keep session records on disk: transcripts, command history, tool output. Credentials end up in them through printed environment variables, pasted tokens and command output. Scan those records for credentials on a schedule shorter than the period they are kept for.
What good looks like
- The storage locations of session records for each approved agent are documented.
- Scans run on a defined schedule that is shorter than the retention period.
- Credentials found are rotated, and the event is recorded.
- Retention of session records is itself limited.
How teams usually do it
- Secret scanners (for example Gitleaks or TruffleHog) pointed at the agents' history and log folders by a scheduled job or endpoint management.
- Shorter retention configured in the agent's settings.
- Keeping session folders out of backups and sync services.
Suggested evidence
- The list of session storage locations.
- The scan schedule and recent results.
- A rotation record following a finding.
Common mistakes
- Not knowing where the agent stores its history.
- Scanning repositories thoroughly and never the home-directory folders where transcripts live.
- Finding a credential and deleting the transcript without rotating it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.