Issues

• Arabic translation of ASVS v5.0.0

  OWASP/ASVS#3405 · Filter by author khalidwalamri opened on Sep 8, 2026

• New requirement proposal (V3): sensitive input fields must be excluded from client-side monitoring and session-recording capture

  1) Discussion ongoingV14 (prev V8)
  OWASP/ASVS#3395 · Filter by author anuragnedunuri opened on Aug 14, 2026
  5

  

• Polish translation of ASVS 5.0

  translation
  OWASP/ASVS#3386 · Filter by author PiotrKleszcz opened on Jul 21, 2026
  2

  

• Requesting Appendix E credit: J-XL (commented on #3335, endorsed by project lead)

  OWASP/ASVS#3365 · Filter by author J-XL opened on Jun 24, 2026
  1

• Clarification of language around HSTS

  4) proposal for reviewV3 (prev V50)
  OWASP/ASVS#3364 · Filter by author tautology0 opened on Jun 24, 2026
  2

• Include info/requirements about Post Quantum Cryptography

  OWASP/ASVS#3361 · Filter by author randomstuff opened on May 29, 2026

• Improve clarity of TLS version requirements in V9.1.3

  V12 (prev V9)
  OWASP/ASVS#3360 · Filter by author sujalavnelavai opened on May 29, 2026
  19

• Reduce maximum lifetime of OAuth authorization code (10.4.3)

  V10 (prev V51)
  OWASP/ASVS#3353 · Filter by author randomstuff opened on Apr 12, 2026
  1

• Proposal: add requirements to verify correct implementation of OAuth PAR and JAR

  V10 (prev V51)
  OWASP/ASVS#3352 · Filter by author mirokarv opened on Apr 2, 2026
  7

• Proposal: High-legibility fonts requirement

  OWASP/ASVS#3349 · Filter by author narfbg opened on Mar 23, 2026
  4

• proposal: add requirement to verify that using a sanitization is an accepted solution for that data or flow

  V1 (prev V5)
  OWASP/ASVS#3346 · Filter by author elarlang opened on Mar 9, 2026
  61

• V11.1.4 restates cryptographic inventory requirement already covered by V11.1.2

  V11 (prev V6)
  OWASP/ASVS#3345 · Filter by author tghosth opened on Mar 5, 2026

• V4.3.3-derived requirement accidentally deleted, mapping is stale

  V13 (prev V14)
  OWASP/ASVS#3344 · Filter by author tghosth opened on Mar 5, 2026

• Are 13.2.4 and 13.2.5 duplicates?

  V13 (prev V14)
  OWASP/ASVS#3343 · Filter by author tghosth opened on Mar 5, 2026
  5

  

• Confirm that no change control tags need to be added yet.

  OWASP/ASVS#3339 · Filter by author tghosth opened on Feb 23, 2026

• Phishing and/or visual deception protections

  4) proposal for reviewV1 (prev V5)
  OWASP/ASVS#3338 · Filter by author narfbg opened on Feb 22, 2026
  16

• Lower level requirement for 6.4.6

  V6 (prev V2)
  OWASP/ASVS#3337 · Filter by author narfbg opened on Feb 22, 2026
  2

• Refine explanation of "sanitization"

  4) proposal for reviewV1 (prev V5)
  OWASP/ASVS#3335 · Filter by author tghosth opened on Feb 19, 2026
  67

• 3.3.4, Require __Http- or __Host-Http- prefix for HttpOnly cookies when applicable

  1) Discussion ongoingV3 (prev V50)
  OWASP/ASVS#3331 · Filter by author randomstuff opened on Feb 12, 2026
  5

• proposal 13.4.* Verify that source maps are disabled in production environments to prevent source code leakage.

  4) proposal for reviewrequires change controlV13 (prev V14)
  OWASP/ASVS#3326 · Filter by author MozharAlhosni opened on Jan 26, 2026
  6

• Clarify CORS validation in 3.4.2 to explicitly reject 'null' origin

  1) Discussion ongoingV3 (prev V50)
  OWASP/ASVS#3322 · Filter by author Galaxy-sc opened on Jan 5, 2026
  12

  

• Clarification request regarding ASVS 5.0 control scope

  2) Awaiting response_5.0 - Not blocker
  OWASP/ASVS#3321 · Filter by author paulobiao opened on Jan 4, 2026
  2

  

• Loss, Theft, Damage, and Compromise with regards to authenticators

  2) Awaiting responseV6 (prev V2)
  OWASP/ASVS#3314 · Filter by author sydseter opened on Dec 12, 2025
  25

• v5.0.0: 13.3.3 is too aggressive/vague

  V13 (prev V14)
  OWASP/ASVS#3306 · Filter by author narfbg opened on Nov 22, 2025
  1

  

• v5.0.0: 6.5.7 conflict with NIST SP 800-63B-4

  4) proposal for reviewrequires change controlV6 (prev V2)
  OWASP/ASVS#3305 · Filter by author narfbg opened on Nov 20, 2025
  26