OWASP/OpenCRE

View on GitHub

Stars: 180
Forks: 137
Open beginner issues: 0
Indexed issues: 101
Avg merge: 3d 23h
Merged PRs (30d): 21

Dominant language: Python
License: CC0-1.0
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

101 open issues indexed

MCP v2: authenticated tools (MyOpenCRE, chat) matching REST authz Open

Difficulty 5/5 Over a week Newbie friendliness 42/100

OWASP/OpenCRE#1108 · Opened Sep 16, 2026
Spelling error: ID: 743-237 | Validatie/enforce HTTP inputs (against HTTP parameter pollution attacks) Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

OWASP/OpenCRE#1106 · 1 comment · Opened Sep 14, 2026
/rest/v1/tags and db.get_by_tags() return unbounded results — pagination TODO never implemented Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

OWASP/OpenCRE#1087 · Opened Sep 9, 2026
Later: filter chat RAG by saved standards selection Open

enhancement not ready for development P3 untriaged

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/OpenCRE#1085 · 1 comment · Opened Sep 8, 2026
Shareable CRE URLs stay the full graph; filter is session-only Open

enhancement not ready for development P2 untriaged

Difficulty 4/5 3-5 days Newbie friendliness 68/100

OWASP/OpenCRE#1084 · Opened Sep 8, 2026
Filter ga_standards by saved selection, with ?all=true bypass Open

enhancement not ready for development P2 untriaged

Difficulty 4/5 3-5 days Newbie friendliness 68/100

OWASP/OpenCRE#1083 · Opened Sep 8, 2026
Apply saved standards selection on search and explorer Open

enhancement not ready for development P2 untriaged

Difficulty 4/5 3-5 days Newbie friendliness 55/100

OWASP/OpenCRE#1082 · Opened Sep 8, 2026
Apply saved standards selection on CRE and standard pages Open

enhancement not ready for development P2 untriaged

Difficulty 4/5 3-5 days Newbie friendliness 55/100

OWASP/OpenCRE#1081 · Opened Sep 8, 2026
Prod: enable CRE_ENABLE_LOGIN and CRE_ENABLE_MYOPENCRE for profiles Open

existing-maintainers-only not ready for development P2 untriaged

Difficulty 3/5 1-2 days Newbie friendliness 45/100

OWASP/OpenCRE#1080 · Opened Sep 8, 2026
Epic: User profiles with persistent standards filter Open

enhancement not ready for development P2 untriaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/OpenCRE#1079 · 1 comment · Opened Sep 8, 2026
Spike: RAGAS (or equivalent) eval for cited OpenCRE Chat Open

enhancement not ready for development untriaged

Difficulty 4/5 1-2 days Newbie friendliness 55/100

OWASP/OpenCRE#1078 · Opened Sep 8, 2026
Spike: Haystack 3 vs in-tree Librarian for chat RAG Open

enhancement not ready for development untriaged

Difficulty 3/5 1-2 days Newbie friendliness 65/100

OWASP/OpenCRE#1077 · Opened Sep 8, 2026
Chat embeddings: retrieve heading/harvest chunks, not whole-node blobs Open

enhancement not ready for development untriaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/OpenCRE#1076 · Opened Sep 8, 2026
Chat: retrieve top-k via Librarian seams (implements #962) Open

enhancement not ready for development untriaged

Difficulty 4/5 3-5 days Newbie friendliness 68/100

OWASP/OpenCRE#1075 · 1 comment · Opened Sep 8, 2026
Cited ask API + MCP tools so NestBot can ground security answers in OpenCRE Open

enhancement not ready for development untriaged

Difficulty 5/5 Over a week Newbie friendliness 42/100

OWASP/OpenCRE#1074 · 1 comment · Opened Sep 8, 2026
Chat/agent: route community questions to Nest APIs (do not rebuild chapters/events) Open

enhancement not ready for development untriaged

Difficulty 4/5 3-5 days Newbie friendliness 55/100

OWASP/OpenCRE#1073 · Opened Sep 8, 2026
Epic: Bidirectional OWASP Agent with Nest (REST first, MCP second) Open

enhancement not ready for development untriaged

Difficulty 5/5 Over a week Newbie friendliness 30/100

OWASP/OpenCRE#1072 · 2 comments · Opened Sep 8, 2026
Continuity runbook: Local stack Open

existing-maintainers-only

Difficulty 3/5 1-2 days Newbie friendliness 65/100

OWASP/OpenCRE#1071 · Opened Sep 8, 2026
Continuity runbook: Staging bootstrap Open

existing-maintainers-only

Difficulty 3/5 1-2 days Newbie friendliness 45/100

OWASP/OpenCRE#1070 · Opened Sep 8, 2026
Continuity runbook: Gap analysis ops Open

existing-maintainers-only

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/OpenCRE#1069 · Opened Sep 8, 2026
Continuity runbook: Catalog import and sync Open

existing-maintainers-only

Difficulty 3/5 1-2 days Newbie friendliness 45/100

OWASP/OpenCRE#1068 · Opened Sep 8, 2026
Continuity runbook: Deploy production Open

existing-maintainers-only

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/OpenCRE#1067 · Opened Sep 8, 2026
Continuity runbook: Production DB surgery Open

existing-maintainers-only

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/OpenCRE#1066 · Opened Sep 8, 2026
Continuity runbook: Production DB backup Open

existing-maintainers-only

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/OpenCRE#1065 · Opened Sep 8, 2026
Continuity runbook: Production health Open

existing-maintainers-only

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/OpenCRE#1064 · Opened Sep 8, 2026
Continuity runbook: Rollback production Open

existing-maintainers-only

Difficulty 4/5 3-5 days Newbie friendliness 25/100

OWASP/OpenCRE#1063 · Opened Sep 8, 2026
Continuity runbook: Restart production Open

existing-maintainers-only

Difficulty 2/5 1-3 hours Newbie friendliness 38/100

OWASP/OpenCRE#1062 · Opened Sep 8, 2026
Continuity runbook: Access inventory Open

existing-maintainers-only

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

OWASP/OpenCRE#1061 · Opened Sep 8, 2026
bug: downward bouncing arrow btn displayed at the end of the landing page Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

OWASP/OpenCRE#1055 · Opened Sep 6, 2026
Mapping an agentic control set into OpenCRE: link targets and two scope questions Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/OpenCRE#1045 · 12 comments · Opened Aug 24, 2026
Deferred from #586: graph-link pruning + ga_standards filtering for per-user resource selection Open

not ready for development untriaged

Difficulty 5/5 Over a week Newbie friendliness 45/100

OWASP/OpenCRE#1043 · 2 comments · Opened Aug 23, 2026
DiffParser silently drops or misattributes diffs for non-ASCII / space-containing file paths Open

bug

OWASP/OpenCRE#1032 · 4 comments · 1 assignee · Opened Aug 21, 2026
Implement opportunistic local GA fetch from prod (RFC merged) Open

Difficulty 5/5 Over a week Newbie friendliness 45/100

OWASP/OpenCRE#1026 · 3 comments · Opened Aug 19, 2026
REST 404s return generic "Resource Not found" and drop abort() descriptions Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 76/100

OWASP/OpenCRE#1020 · 4 comments · Opened Aug 16, 2026
Add AVE (Agentic Vulnerability Enumeration) mappings — Batch 1 (3 pilot mappings) Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

OWASP/OpenCRE#1017 · 2 comments · 1 reaction · Opened Aug 15, 2026
Add AISVS 1.0 mappings Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/OpenCRE#1016 · 2 comments · Opened Aug 14, 2026
Add OWASP Top 10 for LLM Applications 2026 as a mapped resource Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

OWASP/OpenCRE#1015 · 1 comment · Opened Aug 14, 2026
maintainer: drop SQLite — Postgres-only OpenCRE (Makefile, CI, local cache) Open

Difficulty 5/5 Over a week Newbie friendliness 15/100

OWASP/OpenCRE#982 · Opened Jul 15, 2026
Auth-wrap POST /rest/v1/cre_csv_import (deprecate anonymous MyOpenCRE import) Open

OWASP/OpenCRE#966 · 2 comments · 1 assignee · Opened Jul 8, 2026
MyOpenCRE mapping: reuse Module C Librarian retriever/reranker (RFC TODO 3) Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

OWASP/OpenCRE#965 · 2 comments · Opened Jul 8, 2026
Auth: migrate OAuth routes from /rest/v1/login to /rest/v1/auth/* Open

OWASP/OpenCRE#963 · 2 comments · 1 assignee · Opened Jul 8, 2026
Improve OpenCRE Chat substantially by using all relevant resources, instead of just one Open

OWASP/OpenCRE#962 · 2 comments · 1 assignee · Opened Jul 7, 2026
CI: wire the Librarian eval harness in as a merge gate (explicit 100% + optional recall@k) Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

OWASP/OpenCRE#956 · 1 comment · Opened Jul 3, 2026
Research correct CRE mapping for K09 (Misconfigured Cluster Components) in OWASP Kubernetes Top Ten 2022 Open

OWASP/OpenCRE#916 · 4 comments · 1 assignee · Opened Jun 4, 2026
Bug: Infinite loop in `gap_analysis.py` preload blocks background runner Open

OWASP/OpenCRE#885 · 3 comments · 1 assignee · Opened Apr 17, 2026
Pin dependencies to exact versions in requirements.txt for reproducible builds Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

OWASP/OpenCRE#868 · 1 comment · Opened Apr 7, 2026
Startup validation: abort early on missing critical configuration Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

OWASP/OpenCRE#851 · Opened Mar 31, 2026
Unbounded API responses on /rest/v1/root_cres and /rest/v1/all_cres Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

OWASP/OpenCRE#847 · Opened Mar 31, 2026
Contribution: Mapping NIST SP 800-53 Controls to OpenCRE Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/OpenCRE#818 · Opened Mar 19, 2026
Hide scroll-down arrow button when reaching the bottom of the page Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

OWASP/OpenCRE#815 · 1 comment · Opened Mar 18, 2026

OWASP/OpenCRE

Get new issues in your inbox