OSS TanbouOverview
OWASP Application Security Verification Standard (ASVS) is an open standard that organizes security requirements for web applications and web services. It can be used for development checklists, security testing, procurement, and acceptance criteria. The README identifies 5.0.0 as the latest stable release, while master is a moving bleeding-edge version and should be treated separately.
Features and best fit
Based on official documentation; not hands-on tested · Content checked:
Use security requirements as a shared verification baseline
Requirements have identifiers that let engineering, security, and assessment teams reference the same expectations for areas such as authentication, input handling, and access control.
Sources: [2]
Trace requirements from design reviews through acceptance testing
Teams can map ASVS requirements to specifications, test cases, and assessment findings so they can record what was verified and how.
Sources: [2]
For teams that need explicit web-application security requirements
ASVS is useful for internal development, outsourced projects, and product evaluation when organizations need a common set of application-security expectations. Stable releases are published in multiple formats including PDF, Word, and CSV.
Pin a stable version instead of relying on master
The master branch is continuously changing. The README points to stable 5.0.0, and requirement identifiers can change between versions, so audit records and test specifications should use version-qualified IDs.
Official sources
- [1]OWASP/ASVS repository(2026-09-20)
- [2]OWASP ASVS README(2026-09-20)
- [3]OWASP ASVS v5.0.0(2026-09-20)
- [4]OWASP ASVS project page(2026-09-20)
Supplemental curator note
ASVS is a verification standard, not a vulnerability scanner. For audits and acceptance criteria, pin a stable release rather than the moving master branch and record version-qualified requirement IDs such as `v5.0.0-1.2.5`.
Try it in 3 steps
- 1
Pin stable ASVS 5.0.0
Use the stable release rather than master and choose PDF, Word, or CSV according to your review workflow.
https://github.com/OWASP/ASVS/tree/v5.0.0 - 2
Turn applicable requirements into a checklist
Select requirements that apply to the system and reference them with version-qualified IDs such as v5.0.0-1.2.5.
Use v5.0.0 requirement IDs - 3
Record verification evidence and results
Track how each requirement was verified, its evidence, and its outcome while distinguishing unverified from failed checks.
Requirement → evidence → result
Growth
Growth trends · Last 30 days
3,609 Stars
Trend data is still being collected.
Development activity
Last 90 days · weekly
- Commits (last 30 days)
- 3
- Open PRs
- 11
- Issues opened
- 5
- Issues closed
- 3
- PRs opened
- 39
- PRs merged
- 29
Issues
5 / 3
Pull requests
39 / 29
Maintenance
- Median first response
- 17 hr
- Issue response rate
- 80% (4/5)
Based on up to the 100 newest issues opened by external users in the last 90 days. A first comment from an OWNER, MEMBER, or COLLABORATOR counts as a response; issues whose full comment history cannot be checked are excluded. The median and response rate update weekly.
Built with
Categories and tags
Categories
GitHub data
GitHub dataView detailed GitHub data
- Stars
- 3,609
- Forks
- 831
- Watchers
- 150
- Open issues
- 100
- Contributors
- 113
- Primary language
- HTML
- License
- CC-BY-SA-4.0
- Repository last updated
- Sep 3, 2026
Related information
Write a related articleShare a guide or use case for this OSS in Markdown. Articles are published after administrator approval.
Explore next
- Sherlock92,144 Stars
A Python OSINT CLI that checks username-based account candidates across social networks.
Python - Trivy37,984 Stars
A scanner for vulnerabilities, SBOM data, misconfigurations, secrets, and licenses across containers, Kubernetes, and repositories.
Go - HashiCorp Vault36,267 Stars
A security platform centralizing secret storage, short-lived credentials, encryption, leases, and revocation.
Go - Web-Check34,873 Stars
An all-in-one website OSINT tool that takes a URL and surfaces DNS, SSL, WHOIS, ports, subdomains, HTTP headers, cookies, technology stack, and many other checks in one interface.
TypeScript - Nuclei31,317 Stars
A template-driven scanner for authorized assets that expresses HTTP, DNS, TCP, SSL, and other vulnerability or misconfiguration checks in a YAML DSL.
Go
Report incorrect information
Tell us if any listing information is incorrect or outdated.