OWASP Application Security Verification Standard

Source identity:

ddx:
  id: resource.owasp-asvs
  authoring:
    home: repo

OWASP Application Security Verification Standard

Source

URL: https://owasp.org/www-project-application-security-verification-standard/
Accessed: 2026-05-12

Summary

OWASP describes the Application Security Verification Standard (ASVS) as an open standard for testing web application technical security controls and as a source of security requirements for secure development. It provides a common way to define verification coverage and rigor for applications and APIs.

Relevant Findings

ASVS can be used as a list of secure-development requirements.
It provides a basis for testing technical security controls.
Requirements can be referenced by stable versioned identifiers.
The standard covers areas such as architecture, authentication, authorization, data protection, secure communication, logging, and input handling.
ASVS helps teams define verifiable expectations instead of vague security goals.

HELIX Usage

This resource informs Security Requirements, Security Architecture, Security Tests, and Test Plans. HELIX uses it to keep security requirements concrete, versioned where appropriate, and testable.

Authority Boundary

This resource is an application-security verification standard. It does not replace project-specific threat modeling, compliance obligations, privacy law, infrastructure hardening, or incident-response planning.

Innsigle seal: model-primary by HELIX

The signature covers the markdown source of this page, not these HTML bytes. This page quotes that seal; verify it against the source file.

Composition: model-primary
Issuer: HELIX helix
Signing key: ed25519:b0865d76d834a52c48506414d16f4e5a (build key)
Signed source: research/owasp-asvs.md
Signed: 2026-09-23T14:11:58Z
Content digest: sha256:9012b8c5…00e38149

This build key is endorsed by the human key for build signing; the signature is not a detector and not a truth guarantee.

Raw attestation JSON

{
  "payload": {
    "innsigle": "1",
    "type": "https://innsigle.dev/claim/colophon/v1",
    "issued_at": "2026-09-23T14:11:58Z",
    "issuer": {
      "id": "helix",
      "name": "HELIX",
      "key_id": "ed25519:b0865d76d834a52c48506414d16f4e5a",
      "key_url": "https://documentdrivendx.github.io/helix/.well-known/innsigle/keys.json"
    },
    "subjects": [
      {
        "uri": "https://documentdrivendx.github.io/helix/research/owasp-asvs/",
        "digest": {
          "alg": "sha256",
          "value": "9012b8c5ee4be87cf31a964d8c53235173f435162cba3795b451f5cc00e38149"
        }
      }
    ],
    "colophon": {
      "schema_version": "1",
      "composition": "model-primary",
      "ingredients": [
        {
          "kind": "model",
          "name": "Claude",
          "role": "draft"
        },
        {
          "kind": "tool",
          "name": "sloptimizer",
          "role": "rewrite"
        },
        {
          "kind": "human",
          "name": "operator",
          "role": "structure-edit"
        }
      ],
      "notes": null
    }
  },
  "payload_encoding": "json",
  "signatures": [
    {
      "key_id": "ed25519:b0865d76d834a52c48506414d16f4e5a",
      "alg": "ed25519",
      "sig": "pdOoLeppUULn5tE347mYcrYLHbpGOXmqSe7RRRtuETmyVHxQRPXMVEPUrVMVdDi7LVAr4KGBomW8oPsZnZjODg",
      "signed_at": "2026-09-23T14:11:58Z"
    }
  ]
}

attestation file · issuer keys