AI-Assisted Secure Coding (Appendix C) · Validation of AI-Generated Code
Security-scan every AI pull request
Verify that automated security testing runs on every pull request containing AI-generated code: SAST, IAST, DAST, secret scanning, IaC scanning, and SCA. Where the scanner supports them, AI-attribution-aware rules are turned on.
OWASP AISVS v1.01, requirement AC.4.2
In plain English
Run the full set of automated security tests on every pull request that contains AI-generated code. The set is static analysis (SAST), interactive and dynamic testing (IAST, DAST), secret scanning, infrastructure-as-code scanning and dependency analysis (SCA). AI writes plausible code quickly, and that includes plausible vulnerabilities.
What good looks like
- Each listed scanner type runs on every such PR. In practice, run them on every PR.
- AI-attribution-aware rules are switched on where the scanner has them.
- Results appear in the PR before merge.
- Scans cannot be skipped by the PR author.
How teams usually do it
- CI pipelines with SAST (for example CodeQL or Semgrep), secret scanning, IaC scanning (for example Checkov or Trivy) and SCA.
- DAST and IAST against a deployed preview or test environment for the PR.
- Dependency checks that flag new packages which are very new, little used or absent from the registry, to catch invented or squatted names.
Suggested evidence
- CI configuration.
- A sample PR showing results from each scanner.
Common mistakes
- Scanners that run only on the main branch after merge.
- Running SAST and SCA and dropping the dynamic tests because they are harder to set up.
- Scan jobs defined in the PR's own branch, where the author or an agent can edit them out.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.