OWASP/ASVS

View on GitHub

Application Security Verification Standard

Stars: 3.6k
Forks: 831
Open beginner issues: 0
Indexed issues: 100
Avg merge: 7h 55m
Merged PRs (30d): 4

Dominant language: HTML
License: CC-BY-SA-4.0
Last GitHub push: Sep 3, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

100 open issues indexed

Arabic translation of ASVS v5.0.0 Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

OWASP/ASVS#3405 · Opened Sep 8, 2026
New requirement proposal (V3): sensitive input fields must be excluded from client-side monitoring and session-recording capture Open

1) Discussion ongoing V14 (prev V8)

OWASP/ASVS#3395 · 5 comments · 2 assignees · Opened Aug 14, 2026
Polish translation of ASVS 5.0 Open

translation

OWASP/ASVS#3386 · 2 comments · 1 assignee · Opened Jul 21, 2026
Requesting Appendix E credit: J-XL (commented on #3335, endorsed by project lead) Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

OWASP/ASVS#3365 · 1 comment · Opened Jun 24, 2026
Clarification of language around HSTS Open

4) proposal for review V3 (prev V50)

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

OWASP/ASVS#3364 · 2 comments · Opened Jun 24, 2026
Include info/requirements about Post Quantum Cryptography Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/ASVS#3361 · 1 reaction · Opened May 29, 2026
Improve clarity of TLS version requirements in V9.1.3 Open

V12 (prev V9)

Difficulty 2/5 1-3 hours Newbie friendliness 64/100

OWASP/ASVS#3360 · 19 comments · Opened May 29, 2026
Reduce maximum lifetime of OAuth authorization code (10.4.3) Open

V10 (prev V51)

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

OWASP/ASVS#3353 · 1 comment · Opened Apr 12, 2026
Proposal: add requirements to verify correct implementation of OAuth PAR and JAR Open

V10 (prev V51)

Difficulty 4/5 3-5 days Newbie friendliness 48/100

OWASP/ASVS#3352 · 7 comments · Opened Apr 2, 2026
Proposal: High-legibility fonts requirement Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

OWASP/ASVS#3349 · 4 comments · Opened Mar 23, 2026
proposal: add requirement to verify that using a sanitization is an accepted solution for that data or flow Open

V1 (prev V5)

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/ASVS#3346 · 61 comments · Opened Mar 9, 2026
V11.1.4 restates cryptographic inventory requirement already covered by V11.1.2 Open

V11 (prev V6)

Difficulty 1/5 Under an hour Newbie friendliness 55/100

OWASP/ASVS#3345 · 1 reaction · Opened Mar 5, 2026
V4.3.3-derived requirement accidentally deleted, mapping is stale Open

V13 (prev V14)

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/ASVS#3344 · Opened Mar 5, 2026
Are 13.2.4 and 13.2.5 duplicates? Open

V13 (prev V14)

OWASP/ASVS#3343 · 5 comments · 1 assignee · Opened Mar 5, 2026
Confirm that no change control tags need to be added yet. Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3339 · Opened Feb 23, 2026
Phishing and/or visual deception protections Open

4) proposal for review V1 (prev V5)

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/ASVS#3338 · 16 comments · Opened Feb 22, 2026
Lower level requirement for 6.4.6 Open

V6 (prev V2)

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/ASVS#3337 · 2 comments · Opened Feb 22, 2026
Refine explanation of "sanitization" Open

4) proposal for review V1 (prev V5)

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/ASVS#3335 · 67 comments · Opened Feb 19, 2026
3.3.4, Require __Http- or __Host-Http- prefix for HttpOnly cookies when applicable Open

1) Discussion ongoing V3 (prev V50)

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/ASVS#3331 · 5 comments · Opened Feb 12, 2026
proposal 13.4.* Verify that source maps are disabled in production environments to prevent source code leakage. Open

4) proposal for review requires change control V13 (prev V14)

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/ASVS#3326 · 6 comments · Opened Jan 26, 2026
Clarify CORS validation in 3.4.2 to explicitly reject 'null' origin Open

1) Discussion ongoing V3 (prev V50)

OWASP/ASVS#3322 · 12 comments · 1 assignee · Opened Jan 5, 2026
Clarification request regarding ASVS 5.0 control scope Open

_5.0 - Not blocker 2) Awaiting response

OWASP/ASVS#3321 · 2 comments · 1 assignee · Opened Jan 4, 2026
Loss, Theft, Damage, and Compromise with regards to authenticators Open

2) Awaiting response V6 (prev V2)

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3314 · 25 comments · Opened Dec 12, 2025
v5.0.0: 13.3.3 is too aggressive/vague Open

V13 (prev V14)

OWASP/ASVS#3306 · 1 comment · 1 assignee · Opened Nov 22, 2025
v5.0.0: 6.5.7 conflict with NIST SP 800-63B-4 Open

4) proposal for review requires change control V6 (prev V2)

OWASP/ASVS#3305 · 26 comments · 1 reaction · 1 assignee · Opened Nov 20, 2025
Clarification: 2.4.2 "realistic human timing" Open

V2 (prev V11)

Difficulty 3/5 1-2 days Newbie friendliness 30/100

OWASP/ASVS#3302 · 16 comments · Opened Nov 18, 2025
Clarification: 2.3.3 "entirety or it is rolled back " Open

V2 (prev V11)

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3301 · 3 comments · Opened Nov 17, 2025
Clarification: 2.3.1 "same user" " expected sequential step order" "without skipping steps" Open

V2 (prev V11)

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/ASVS#3300 · 2 comments · Opened Nov 17, 2025
Clarification: V2 Text Statement "High‑value" Open

V2 (prev V11) Will be closed if no response/opposite arguments

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3299 · 3 comments · Opened Nov 17, 2025
Clarification: V2 Text Statement "sequential, processed in order, and cannot be bypassed." Open

V2 (prev V11)

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/ASVS#3294 · 5 comments · Opened Nov 12, 2025
Clarification 1.2.1: How requirement apply to Single Page Applications (SPA) architectures Open

V1 (prev V5) Will be closed if no response/opposite arguments

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3292 · 12 comments · Opened Nov 12, 2025
Clarification 1.1.2: How requirement apply to Single Page Applications (SPA) architectures Open

V1 (prev V5) Will be closed if no response/opposite arguments

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3291 · 2 comments · Opened Nov 12, 2025
Clarification 1.1.1: How requirement apply to Single Page Applications (SPA) architectures Open

V1 (prev V5) Will be closed if no response/opposite arguments

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3290 · 2 comments · Opened Nov 11, 2025
Panjabi Translation of ASVS v5.0.0 Open

translation

Difficulty 4/5 3-5 days Newbie friendliness 25/100

OWASP/ASVS#3252 · 2 comments · Opened Sep 17, 2025
Clarification: 1.5.3 "consistent" Open

V1 (prev V5)

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/ASVS#3248 · 3 comments · Opened Aug 26, 2025
Clarification: 1.5.2 "insecure" Open

requires change control V1 (prev V5)

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3247 · 2 comments · Opened Aug 26, 2025
Clarification: 1.5.1"and" Open

2) Awaiting response V1 (prev V5)

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3246 · 2 comments · Opened Aug 26, 2025
Clarification: 1.3.7 "Built" Open

4) proposal for review V1 (prev V5)

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3245 · 19 comments · Opened Aug 19, 2025
Clarification: 1.3.6 "dangerous characters" Open

4a) Waiting for another V1 (prev V5)

Difficulty 4/5 3-5 days Newbie friendliness 30/100

OWASP/ASVS#3244 · 25 comments · Opened Aug 19, 2025
v5.0.0-3.4.5 focus to avoid leakage from 'referer' instead of "have a policy" Open

V3 (prev V50)

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

OWASP/ASVS#3243 · 9 comments · Opened Aug 18, 2025
v5.0.0-6.2.1 password min length vs NIST SP 800-63B-4 Open

V6 (prev V2)

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/ASVS#3242 · 6 comments · 1 reaction · Opened Aug 18, 2025
Spanish translation of ASVS v5.0.0 Open

translation

Difficulty 4/5 3-5 days Newbie friendliness 45/100

OWASP/ASVS#3238 · 7 comments · 2 reactions · Opened Aug 8, 2025
Clarification: 1.3.12 "sanitized" Open

2) Awaiting response V1 (prev V5)

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

OWASP/ASVS#3237 · 2 comments · Opened Aug 8, 2025
Clarification: 1.3.11 SMTP Open

4a) Waiting for another V1 (prev V5)

Difficulty 4/5 3-5 days Newbie friendliness 25/100

OWASP/ASVS#3236 · 30 comments · Opened Aug 8, 2025
Clarification: 1.3.5 "disable" Open

6) PR awaiting review requires change control V1 (prev V5)

Difficulty 4/5 3-5 days Newbie friendliness 45/100

OWASP/ASVS#3235 · 13 comments · Opened Aug 8, 2025
Clarification: 1.3.4 “Draw graphics” Open

4a) Waiting for another V1 (prev V5)

Difficulty 3/5 1-2 days Newbie friendliness 42/100

OWASP/ASVS#3234 · 5 comments · Opened Aug 8, 2025
Clarification: 1.3.2 "Sanitized" Open

4a) Waiting for another V1 (prev V5)

Difficulty 5/5 Over a week Newbie friendliness 30/100

OWASP/ASVS#3232 · 4 comments · Opened Aug 8, 2025
Clarification: 1.3.1 WYSIWYG Open

4) proposal for review V1 (prev V5)

Difficulty 4/5 3-5 days Newbie friendliness 30/100

OWASP/ASVS#3231 · 26 comments · Opened Aug 8, 2025
Clarification: 1.2.10 "single quote" Open

2) Awaiting response V1 (prev V5)

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/ASVS#3230 · 3 comments · Opened Aug 8, 2025
Clarification: 1.2.9 "typically using a backslash" Open

1) Discussion ongoing 3) awaiting proposal V1 (prev V5)

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

OWASP/ASVS#3229 · 7 comments · Opened Aug 8, 2025

OWASP/ASVS

Get new issues in your inbox