AI-Assisted Secure Coding (Appendix C) · Continuous Feedback, Adversarial Testing & Model Fine-Tuning
Feed flags back into the tooling
Verify that aggregated feedback feeds into periodic system-prompt updates or retrieval-augmented generation against vetted secure-coding corpora (OWASP Cheat Sheets, internal coding standards). Where the organization controls model training infrastructure, fine-tuning on the same feedback corpus is also required.
OWASP AISVS v1.01, requirement AC.6.2
In plain English
Use the flags you collect to improve the tools. Update system prompts, or give the assistant retrieval over vetted secure-coding guidance such as the OWASP Cheat Sheets and your own standards. If you run your own model training, fine-tune on the feedback too.
What good looks like
- Aggregated feedback is reviewed on a schedule.
- System prompts, rules files or retrieval sources are updated from recurring themes.
- The guidance the assistant retrieves comes from vetted sources.
- Changes are tested before release (see AC.6.4), and if you control training, the feedback corpus is used for fine-tuning.
How teams usually do it
- Organisation-level custom instructions or rules files with your secure-coding standards, kept in version control.
- Retrieval over the OWASP Cheat Sheet Series and internal standards through the tool's knowledge-base feature or an MCP server.
- A quarterly review that turns the top feedback themes into instruction or corpus changes.
Suggested evidence
- Change history for prompts, rules and sources, tied to feedback themes.
- Review meeting records.
Common mistakes
- Collecting feedback with no route back into the tools.
- Feeding raw, unreviewed feedback into prompts or training, which is a poisoning route.
- Instruction files that grow until they contradict themselves.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.