AI-Assisted Secure Coding (Appendix C) · Continuous Feedback, Adversarial Testing & Model Fine-Tuning
Let people flag bad suggestions
Verify that developers and reviewers can flag insecure or non-compliant suggestions, and that each flag is tracked to closure with links back to the originating prompt and response and forward to any downstream artifacts.
OWASP AISVS v1.01, requirement AC.6.1
In plain English
Give developers and reviewers an easy way to flag an insecure or non-compliant AI suggestion, and track each flag until it is closed. Each flag should link back to the prompt and response that produced the suggestion and forward to any code that used it.
What good looks like
- Flagging takes a few seconds, from where the developer already is.
- Each flag becomes a tracked item with an owner and a closure state.
- The flag links to the originating prompt and response.
- It links forward to commits or artifacts where the suggestion was used.
How teams usually do it
- A label, template or slash command in the issue tracker, reachable from the IDE or the PR.
- Capturing the session ID with the flag (see AC.5.1) so the prompt can be found.
- A search for other places the same flawed pattern was accepted.
Suggested evidence
- Recent flags and their outcomes.
- One flag traced back to its prompt and forward to affected code.
Common mistakes
- A thumbs-down button that reports only to the vendor.
- Flags that land in a channel and are never closed.
- Fixing the flagged instance and never looking for the same suggestion accepted elsewhere.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.