AI-Assisted Secure Coding (Appendix C) · Validation of AI-Generated Code
Block merges on critical findings
Verify that pull requests containing AI-generated code are blocked from merging when an automated scan surfaces a critical security finding, defined as CVSS >= 9.0 or the equivalent threshold in the organization's vulnerability severity policy. Bypassing the block requires a written exception approved by an authorized human.
OWASP AISVS v1.01, requirement AC.4.3
In plain English
When a scan finds a critical security issue in a pull request containing AI-generated code, block the merge. Critical means CVSS 9.0 or above, or the equivalent in your own severity policy. Getting past the block should take a written exception approved by an authorised person.
What good looks like
- Critical findings stop the merge automatically.
- The threshold is defined and matches your vulnerability policy.
- A bypass needs a written exception with a named, authorised approver.
- Exceptions are logged, time-limited and reviewed.
How teams usually do it
- Required status checks tied to scanner severity, enforced by branch protection that applies to administrators as well.
- An exception workflow in the ticketing system or the code platform's bypass feature, which records who approved and why.
- A regular review of open exceptions.
Suggested evidence
- Branch protection settings.
- Exception records.
- A PR that was blocked on a critical finding.
Common mistakes
- Making the check optional so it can be ignored under pressure.
- Admins merging past the check with no record.
- Marking the finding as a false positive to make the block go away.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.