From 04a4b1d9e76543865d9fe858da8da6a91a930f4e Mon Sep 17 00:00:00 2001 From: emmanuelgjr Date: Fri, 18 Sep 2026 15:54:03 -0400 Subject: [PATCH 1/5] ASVS: parse requirement ids before re-mapping them (prerequisite, #35 class) The ASVS files were left out of the per-framework id grammar in #110 because ASVS was not among the ten frameworks that PR covered. The same swapped-column bug was still present: DSGAI_ASVS.md writes "| V8.1.1 - Sensitive data... | V8 Data Protection |", so control_id held the chapter and the requirement id sat inside control_name on 67 of the 151 ASVS rows. Adds the ASVS grammar - requirement ids V.
., with the chapter as parent - so all 151 rows now carry a requirement id, and migrates the registry off the ids the old parse produced (75 -> 82 items, 17 chapter entries converted). The other ten frameworks are unchanged, which the migration run confirms: 0 added, 0 unresolved for each. This had to land before the 4.0.3 -> 5.0 translation: two thirds of the rows had no requirement id to translate. Co-Authored-By: Claude Opus 5 (1M context) --- data/backlinks.json | 860 ++++++++++++++----------- data/entries/DSGAI01.json | 25 +- data/entries/DSGAI02.json | 20 +- data/entries/DSGAI03.json | 20 +- data/entries/DSGAI04.json | 20 +- data/entries/DSGAI05.json | 15 +- data/entries/DSGAI06.json | 15 +- data/entries/DSGAI07.json | 15 +- data/entries/DSGAI08.json | 15 +- data/entries/DSGAI09.json | 15 +- data/entries/DSGAI10.json | 10 +- data/entries/DSGAI11.json | 20 +- data/entries/DSGAI12.json | 20 +- data/entries/DSGAI13.json | 15 +- data/entries/DSGAI14.json | 20 +- data/entries/DSGAI15.json | 15 +- data/entries/DSGAI16.json | 15 +- data/entries/DSGAI17.json | 10 +- data/entries/DSGAI18.json | 10 +- data/entries/DSGAI19.json | 15 +- data/entries/DSGAI20.json | 15 +- data/entries/DSGAI21.json | 10 +- data/frameworks/cis-controls.json | 5 + data/frameworks/cwe-cve.json | 5 + data/frameworks/eu-ai-act.json | 5 + data/frameworks/iso-42001.json | 5 + data/frameworks/nist-sp-800-218a.json | 5 + data/frameworks/nist-sp-800-82.json | 5 + data/frameworks/owasp-ai-testing.json | 5 + data/frameworks/owasp-asvs.json | 484 +++++++++------ data/frameworks/owasp-nhi.json | 5 + data/frameworks/pci-dss.json | 5 + data/frameworks/soc2.json | 5 + data/stats.json | 6 +- docs/backlinks.js | 862 +++++++++++++++----------- docs/data.js | 335 ++++++---- docs/frameworks-registry.js | 534 ++++++++++------ scripts/control-ids.js | 11 + 38 files changed, 2069 insertions(+), 1408 deletions(-) diff --git a/data/backlinks.json b/data/backlinks.json index a8afcc9..dc996c7 100644 --- a/data/backlinks.json +++ b/data/backlinks.json @@ -30526,31 +30526,6 @@ } ] }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V1 Architecture", - "control_name": "V1.1.4 — Trust boundaries documented and enforced", - "entries": [ - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - } - ] - }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V1.1.2", @@ -30582,29 +30557,29 @@ "tier": "Foundational", "scope": "Both", "notes": "Supply chain threat model documents all agent component sources and trust levels" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10 Malicious Code", - "control_name": "V10.2.1 — Application only uses official repositories", + "control_id": "V1.1.4", + "control_name": "Trust boundaries documented and enforced", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", "notes": null } @@ -30641,6 +30616,15 @@ "tier": "Foundational", "scope": "Both", "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, @@ -30666,44 +30650,19 @@ "tier": "Foundational", "scope": "Both", "notes": "Approved component list — unsigned or unverified agent components rejected" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.4 — Business logic limits on repeated actions", - "entries": [ - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", "notes": null }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", @@ -30829,35 +30788,51 @@ "tier": "Foundational", "scope": "Both", "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V12 Files/Resources", - "control_name": "V12.1.1 — File upload size limits", - "entries": [ + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V11.1.5", + "control_name": "Business logic prevents excess data access", + "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V11.1.7", + "control_name": "Anti-automation controls", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -30897,26 +30872,19 @@ "tier": "Hardening", "scope": "Both", "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V13 API", - "control_name": "V13.1.1 — API protection against enumeration", - "entries": [ + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Build", + "tier": "Hardening", + "scope": "Both", "notes": null }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -30925,6 +30893,22 @@ } ] }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V12.1.3", + "control_name": "Malicious file detection on upload", + "entries": [ + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V13.1.1", @@ -30965,6 +30949,31 @@ "tier": "Hardening", "scope": "Both", "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V13.1.2", + "control_name": "API throttling", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, @@ -30995,8 +31004,8 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14 Configuration", - "control_name": "V14.1.4 — All components inventoried", + "control_id": "V14.1.4", + "control_name": "All components inventoried", "entries": [ { "id": "DSGAI03", @@ -31061,9 +31070,18 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2 Authentication", - "control_name": "V2.1.1 — Passwords minimum 12 characters", + "control_id": "V2.1.1", + "control_name": "Verify credentials not in source code", "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credentials not hardcoded — secret manager required" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -31086,24 +31104,24 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", - "control_name": "Verify credentials not in source code", + "control_id": "V2.10.1", + "control_name": "Integration secrets not hardcoded", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials not hardcoded — secret manager required" + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3 Session Management", - "control_name": "V3.1.1 — Session tokens unique and random", + "control_id": "V3.1.1", + "control_name": "Session tokens unique and random", "entries": [ { "id": "DSGAI11", @@ -31138,40 +31156,40 @@ "tier": "Hardening", "scope": "Both", "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.3 — Deny by default access control", + "control_id": "V4.1.1", + "control_name": "Verify all sensitive functions have access control", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - }, - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null + "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session" }, { "id": "DSGAI06", @@ -31183,21 +31201,12 @@ "notes": null }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", + "scope": "Build", "notes": null }, { @@ -31209,15 +31218,6 @@ "scope": "Build", "notes": null }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, { "id": "DSGAI14", "name": "Excessive Telemetry and Monitoring Leakage", @@ -31228,12 +31228,28 @@ "notes": null }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V4.1.2", + "control_name": "Least privilege for service accounts", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { @@ -31253,40 +31269,6 @@ "tier": "Foundational", "scope": "Both", "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", - "control_name": "Verify all sensitive functions have access control", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session" } ] }, @@ -31366,30 +31348,7 @@ "tier": "Hardening", "scope": "Both", "notes": "A2A channels enforce sender identity — unauthenticated messages rejected" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.2.2", - "control_name": "Verify anti-CSRF tokens in state-changing operations", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "CSRF protection on endpoints where LLM output triggers state changes" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.8 — Output encoding for context", - "entries": [ + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -31400,58 +31359,63 @@ "notes": null }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V4.1.5", + "control_name": "Access control failures logged", + "entries": [ { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V4.2.2", + "control_name": "Verify anti-CSRF tokens in state-changing operations", + "entries": [ { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "CSRF protection on endpoints where LLM output triggers state changes" } ] }, @@ -31495,6 +31459,24 @@ "tier": "Hardening", "scope": "Both", "notes": "All content entering agent memory validated — injection patterns rejected at write boundary" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, @@ -31514,6 +31496,31 @@ } ] }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V5.1.3", + "control_name": "Input validation server-side", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V5.2.1", @@ -31572,6 +31579,15 @@ "tier": "Foundational", "scope": "Both", "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, @@ -31640,6 +31656,63 @@ "tier": "Hardening", "scope": "Both", "notes": "Agent-generated commands validated before any shell execution" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V5.2.6", + "control_name": "Defined output structure", + "entries": [ + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V5.2.8", + "control_name": "Output encoding for context", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V5.3.4", + "control_name": "SQL injection prevention", + "entries": [ + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, @@ -31668,40 +31741,6 @@ } ] }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V6 Cryptography", - "control_name": "V6.1.1 — Sensitive data not stored in cleartext", - "entries": [ - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V6.1.1", @@ -31742,41 +31781,57 @@ "tier": "Hardening", "scope": "Both", "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.2.2 — Log entries contain required information", - "entries": [ + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V7.1.1", + "control_name": "No credential logging", + "entries": [ + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V7.1.2", + "control_name": "No sensitive data in logs", + "entries": [ { "id": "DSGAI14", "name": "Excessive Telemetry and Monitoring Leakage", @@ -31862,6 +31917,24 @@ "tier": "Hardening", "scope": "Both", "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, @@ -31905,84 +31978,98 @@ "tier": "Foundational", "scope": "Both", "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.1 — Sensitive data not transmitted in URL parameters", + "control_id": "V8.1.1", + "control_name": "Verify sensitive data is not cached or exposed in logs", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "System prompts not stored in cleartext application configuration or source code" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.1.3", + "control_name": "Sensitive data not in session storage", + "entries": [ { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "tier": "Foundational", "scope": "Build", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.1.4", + "control_name": "Sensitive data minimisation", + "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Build", + "tier": "Hardening", + "scope": "Both", "notes": null }, { @@ -31995,29 +32082,27 @@ "notes": null }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.3.10", + "control_name": "Personal data not kept longer than needed", + "entries": [ { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", "notes": null } @@ -32025,26 +32110,26 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data is not cached or exposed in logs", + "control_id": "V8.3.3", + "control_name": "Consent obtained before PI processing", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" + "notes": null }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "System prompts not stored in cleartext application configuration or source code" + "notes": null } ] }, @@ -32061,19 +32146,55 @@ "tier": "Foundational", "scope": "Both", "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9 Communication", - "control_name": "V9.1.1 — TLS for all connections", + "control_id": "V8.3.7", + "control_name": "Data transferred using current TLS", "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null @@ -32102,6 +32223,15 @@ "tier": "Hardening", "scope": "Both", "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, diff --git a/data/entries/DSGAI01.json b/data/entries/DSGAI01.json index aed2bae..d6b8b5a 100644 --- a/data/entries/DSGAI01.json +++ b/data/entries/DSGAI01.json @@ -315,46 +315,51 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.1 — Sensitive data not transmitted in URL parameters", + "control_id": "V8.1.1", + "control_name": "Sensitive data not transmitted in URL parameters", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.4 — Sensitive data identified and classified", + "control_id": "V8.3.4", + "control_name": "Sensitive data identified and classified", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.3 — Deny by default access control", + "control_id": "V4.1.3", + "control_name": "Deny by default access control", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.8 — Output encoding for context", + "control_id": "V5.2.8", + "control_name": "Output encoding for context", "tier": "Foundational", "scope": "Both", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6 Cryptography", - "control_name": "V6.1.1 — Sensitive data not stored in cleartext", + "control_id": "V6.1.1", + "control_name": "Sensitive data not stored in cleartext", "tier": "Foundational", "scope": "Both", + "parent": "V6", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI02.json b/data/entries/DSGAI02.json index c370021..0a541f8 100644 --- a/data/entries/DSGAI02.json +++ b/data/entries/DSGAI02.json @@ -315,37 +315,41 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2 Authentication", - "control_name": "V2.1.1 — Passwords minimum 12 characters", + "control_id": "V2.1.1", + "control_name": "Passwords minimum 12 characters", "tier": "Foundational", "scope": "Both", + "parent": "V2", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2 Authentication", - "control_name": "V2.10.1 — Integration secrets not hardcoded", + "control_id": "V2.10.1", + "control_name": "Integration secrets not hardcoded", "tier": "Foundational", "scope": "Both", + "parent": "V2", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.2 — Least privilege for service accounts", + "control_id": "V4.1.2", + "control_name": "Least privilege for service accounts", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.7 — Data transferred using current TLS", + "control_id": "V8.3.7", + "control_name": "Data transferred using current TLS", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI03.json b/data/entries/DSGAI03.json index 5e05330..085c174 100644 --- a/data/entries/DSGAI03.json +++ b/data/entries/DSGAI03.json @@ -305,37 +305,41 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V1 Architecture", - "control_name": "V1.1.4 — Trust boundaries documented and enforced", + "control_id": "V1.1.4", + "control_name": "Trust boundaries documented and enforced", "tier": "Foundational", "scope": "Both", + "parent": "V1", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.5 — Access control failures logged", + "control_id": "V4.1.5", + "control_name": "Access control failures logged", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.2.2 — Log entries contain required information", + "control_id": "V7.2.2", + "control_name": "Log entries contain required information", "tier": "Foundational", "scope": "Both", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14 Configuration", - "control_name": "V14.1.4 — All components inventoried", + "control_id": "V14.1.4", + "control_name": "All components inventoried", "tier": "Foundational", "scope": "Both", + "parent": "V14", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI04.json b/data/entries/DSGAI04.json index 04ddbaa..3e2d74a 100644 --- a/data/entries/DSGAI04.json +++ b/data/entries/DSGAI04.json @@ -305,37 +305,41 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.1.3 — Input validation server-side", + "control_id": "V5.1.3", + "control_name": "Input validation server-side", "tier": "Hardening", "scope": "Both", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10 Malicious Code", - "control_name": "V10.2.1 — Application only uses official repositories", + "control_id": "V10.2.1", + "control_name": "Application only uses official repositories", "tier": "Hardening", "scope": "Both", + "parent": "V10", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10 Malicious Code", - "control_name": "V10.2.2 — Dependency managers check for vulnerabilities", + "control_id": "V10.2.2", + "control_name": "Dependency managers check for vulnerabilities", "tier": "Hardening", "scope": "Both", + "parent": "V10", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12 Files/Resources", - "control_name": "V12.1.1 — File upload size limits", + "control_id": "V12.1.1", + "control_name": "File upload size limits", "tier": "Hardening", "scope": "Both", + "parent": "V12", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI05.json b/data/entries/DSGAI05.json index db39c46..5f845df 100644 --- a/data/entries/DSGAI05.json +++ b/data/entries/DSGAI05.json @@ -285,28 +285,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.1.1 — Input validation using allowlists", + "control_id": "V5.1.1", + "control_name": "Input validation using allowlists", "tier": "Foundational", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.1 — HTML/JS output sanitised", + "control_id": "V5.2.1", + "control_name": "HTML/JS output sanitised", "tier": "Foundational", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.4.1 — Generic error messages", + "control_id": "V7.4.1", + "control_name": "Generic error messages", "tier": "Foundational", "scope": "Build", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI06.json b/data/entries/DSGAI06.json index 4388c37..41e38dc 100644 --- a/data/entries/DSGAI06.json +++ b/data/entries/DSGAI06.json @@ -295,28 +295,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control on every request", + "control_id": "V4.1.1", + "control_name": "Access control on every request", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9 Communication", - "control_name": "V9.1.1 — TLS for all connections", + "control_id": "V9.1.1", + "control_name": "TLS for all connections", "tier": "Foundational", "scope": "Both", + "parent": "V9", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.4 — Business logic limits on repeated actions", + "control_id": "V11.1.4", + "control_name": "Business logic limits on repeated actions", "tier": "Foundational", "scope": "Both", + "parent": "V11", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI07.json b/data/entries/DSGAI07.json index 6824e87..9ef4ac2 100644 --- a/data/entries/DSGAI07.json +++ b/data/entries/DSGAI07.json @@ -305,28 +305,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.4 — Sensitive data minimisation", + "control_id": "V8.1.4", + "control_name": "Sensitive data minimisation", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.4 — Sensitive data identified and classified", + "control_id": "V8.3.4", + "control_name": "Sensitive data identified and classified", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.5 — Attribute-based access control", + "control_id": "V4.1.5", + "control_name": "Attribute-based access control", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI08.json b/data/entries/DSGAI08.json index b3d3160..9e14652 100644 --- a/data/entries/DSGAI08.json +++ b/data/entries/DSGAI08.json @@ -295,28 +295,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.3 — Consent obtained before PI processing", + "control_id": "V8.3.3", + "control_name": "Consent obtained before PI processing", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.10 — Personal data not kept longer than needed", + "control_id": "V8.3.10", + "control_name": "Personal data not kept longer than needed", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.2.2 — Audit trail sufficient for compliance", + "control_id": "V7.2.2", + "control_name": "Audit trail sufficient for compliance", "tier": "Foundational", "scope": "Both", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI09.json b/data/entries/DSGAI09.json index 3544041..278f624 100644 --- a/data/entries/DSGAI09.json +++ b/data/entries/DSGAI09.json @@ -295,28 +295,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.5 — Unstructured data sanitised", + "control_id": "V5.2.5", + "control_name": "Unstructured data sanitised", "tier": "Hardening", "scope": "Both", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.4 — Sensitive data minimised", + "control_id": "V8.1.4", + "control_name": "Sensitive data minimised", "tier": "Hardening", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12 Files/Resources", - "control_name": "V12.1.3 — Malicious file detection on upload", + "control_id": "V12.1.3", + "control_name": "Malicious file detection on upload", "tier": "Hardening", "scope": "Both", + "parent": "V12", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI10.json b/data/entries/DSGAI10.json index f56bfcb..7ffa9ad 100644 --- a/data/entries/DSGAI10.json +++ b/data/entries/DSGAI10.json @@ -275,19 +275,21 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.4 — Sensitive data classified", + "control_id": "V8.3.4", + "control_name": "Sensitive data classified", "tier": "Hardening", "scope": "Build", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.6 — Defined output structure", + "control_id": "V5.2.6", + "control_name": "Defined output structure", "tier": "Hardening", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI11.json b/data/entries/DSGAI11.json index 3ea0e3d..062e1b9 100644 --- a/data/entries/DSGAI11.json +++ b/data/entries/DSGAI11.json @@ -295,37 +295,41 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3 Session Management", - "control_name": "V3.1.1 — Session tokens unique and random", + "control_id": "V3.1.1", + "control_name": "Session tokens unique and random", "tier": "Foundational", "scope": "Build", + "parent": "V3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3 Session Management", - "control_name": "V3.3.1 — Sessions invalidated after logout", + "control_id": "V3.3.1", + "control_name": "Sessions invalidated after logout", "tier": "Foundational", "scope": "Build", + "parent": "V3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control enforced on every request", + "control_id": "V4.1.1", + "control_name": "Access control enforced on every request", "tier": "Foundational", "scope": "Build", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.3 — Sensitive data not in session storage", + "control_id": "V8.1.3", + "control_name": "Sensitive data not in session storage", "tier": "Foundational", "scope": "Build", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI12.json b/data/entries/DSGAI12.json index d877460..2eb09ec 100644 --- a/data/entries/DSGAI12.json +++ b/data/entries/DSGAI12.json @@ -305,37 +305,41 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.1.1 — Allowlist input validation", + "control_id": "V5.1.1", + "control_name": "Allowlist input validation", "tier": "Foundational", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.3.4 — SQL injection prevention", + "control_id": "V5.3.4", + "control_name": "SQL injection prevention", "tier": "Foundational", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control on every request", + "control_id": "V4.1.1", + "control_name": "Access control on every request", "tier": "Foundational", "scope": "Build", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13 API", - "control_name": "V13.1.1 — API protection against enumeration", + "control_id": "V13.1.1", + "control_name": "API protection against enumeration", "tier": "Foundational", "scope": "Build", + "parent": "V13", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI13.json b/data/entries/DSGAI13.json index 6072030..466f0b6 100644 --- a/data/entries/DSGAI13.json +++ b/data/entries/DSGAI13.json @@ -295,28 +295,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.3 — Deny by default", + "control_id": "V4.1.3", + "control_name": "Deny by default", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6 Cryptography", - "control_name": "V6.1.1 — Sensitive data not stored in cleartext", + "control_id": "V6.1.1", + "control_name": "Sensitive data not stored in cleartext", "tier": "Foundational", "scope": "Both", + "parent": "V6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12 Files/Resources", - "control_name": "V12.1.1 — File upload validation", + "control_id": "V12.1.1", + "control_name": "File upload validation", "tier": "Foundational", "scope": "Both", + "parent": "V12", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI14.json b/data/entries/DSGAI14.json index 2c5dc3b..37f29c3 100644 --- a/data/entries/DSGAI14.json +++ b/data/entries/DSGAI14.json @@ -295,37 +295,41 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.1.1 — No credential logging", + "control_id": "V7.1.1", + "control_name": "No credential logging", "tier": "Foundational", "scope": "Build", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.1.2 — No sensitive data in logs", + "control_id": "V7.1.2", + "control_name": "No sensitive data in logs", "tier": "Foundational", "scope": "Build", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.1 — Sensitive data not in URLs", + "control_id": "V8.1.1", + "control_name": "Sensitive data not in URLs", "tier": "Foundational", "scope": "Build", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control on log stores", + "control_id": "V4.1.1", + "control_name": "Access control on log stores", "tier": "Foundational", "scope": "Build", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI15.json b/data/entries/DSGAI15.json index 65bcc95..600468e 100644 --- a/data/entries/DSGAI15.json +++ b/data/entries/DSGAI15.json @@ -295,28 +295,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.3 — Deny by default access control", + "control_id": "V4.1.3", + "control_name": "Deny by default access control", "tier": "Foundational", "scope": "Build", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.4 — Data minimisation", + "control_id": "V8.1.4", + "control_name": "Data minimisation", "tier": "Foundational", "scope": "Build", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3 Session Management", - "control_name": "V3.1.1 — Session isolation", + "control_id": "V3.1.1", + "control_name": "Session isolation", "tier": "Foundational", "scope": "Build", + "parent": "V3", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI16.json b/data/entries/DSGAI16.json index 607fbe0..a6337d8 100644 --- a/data/entries/DSGAI16.json +++ b/data/entries/DSGAI16.json @@ -295,28 +295,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.2 — Least privilege", + "control_id": "V4.1.2", + "control_name": "Least privilege", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.5 — Business logic prevents excess data access", + "control_id": "V11.1.5", + "control_name": "Business logic prevents excess data access", "tier": "Foundational", "scope": "Both", + "parent": "V11", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V1 Architecture", - "control_name": "V1.1.2 — Secure architecture and design", + "control_id": "V1.1.2", + "control_name": "Secure architecture and design", "tier": "Foundational", "scope": "Both", + "parent": "V1", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI17.json b/data/entries/DSGAI17.json index 7eaf5ab..d84e91e 100644 --- a/data/entries/DSGAI17.json +++ b/data/entries/DSGAI17.json @@ -285,19 +285,21 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.7 — Anti-automation controls", + "control_id": "V11.1.7", + "control_name": "Anti-automation controls", "tier": "Foundational", "scope": "Both", + "parent": "V11", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13 API", - "control_name": "V13.1.2 — API throttling", + "control_id": "V13.1.2", + "control_name": "API throttling", "tier": "Foundational", "scope": "Both", + "parent": "V13", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI18.json b/data/entries/DSGAI18.json index ca6d2ac..e2f7fca 100644 --- a/data/entries/DSGAI18.json +++ b/data/entries/DSGAI18.json @@ -275,19 +275,21 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.4 — Sensitive data identified", + "control_id": "V8.3.4", + "control_name": "Sensitive data identified", "tier": "Hardening", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6 Cryptography", - "control_name": "V6.1.1 — Sensitive data not stored in cleartext", + "control_id": "V6.1.1", + "control_name": "Sensitive data not stored in cleartext", "tier": "Hardening", "scope": "Both", + "parent": "V6", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI19.json b/data/entries/DSGAI19.json index 6d9ed85..2199731 100644 --- a/data/entries/DSGAI19.json +++ b/data/entries/DSGAI19.json @@ -285,28 +285,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.2 — Least privilege", + "control_id": "V4.1.2", + "control_name": "Least privilege", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.3 — Consent for personal data processing", + "control_id": "V8.3.3", + "control_name": "Consent for personal data processing", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2 Authentication", - "control_name": "V2.1.1 — Strong authentication", + "control_id": "V2.1.1", + "control_name": "Strong authentication", "tier": "Foundational", "scope": "Both", + "parent": "V2", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI20.json b/data/entries/DSGAI20.json index accb34f..207b529 100644 --- a/data/entries/DSGAI20.json +++ b/data/entries/DSGAI20.json @@ -295,28 +295,31 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control per request", + "control_id": "V4.1.1", + "control_name": "Access control per request", "tier": "Hardening", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.4 — Data minimisation in responses", + "control_id": "V8.1.4", + "control_name": "Data minimisation in responses", "tier": "Hardening", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10 Malicious Code", - "control_name": "V10.2.2 — Component integrity checking", + "control_id": "V10.2.2", + "control_name": "Component integrity checking", "tier": "Hardening", "scope": "Both", + "parent": "V10", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI21.json b/data/entries/DSGAI21.json index e4df173..00ea27e 100644 --- a/data/entries/DSGAI21.json +++ b/data/entries/DSGAI21.json @@ -305,19 +305,21 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.1.3 — Server-side input validation", + "control_id": "V5.1.3", + "control_name": "Server-side input validation", "tier": "Hardening", "scope": "Both", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.4 — Enforce business logic limits", + "control_id": "V11.1.4", + "control_name": "Enforce business logic limits", "tier": "Hardening", "scope": "Both", + "parent": "V11", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/frameworks/cis-controls.json b/data/frameworks/cis-controls.json index 37ee5ef..8b454c7 100644 --- a/data/frameworks/cis-controls.json +++ b/data/frameworks/cis-controls.json @@ -508,6 +508,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 70 items -> 68, including 14 referenced by mappings but absent from the registry", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 68 items -> 68", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { diff --git a/data/frameworks/cwe-cve.json b/data/frameworks/cwe-cve.json index dfe718e..f1a0020 100644 --- a/data/frameworks/cwe-cve.json +++ b/data/frameworks/cwe-cve.json @@ -397,6 +397,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 76 items -> 61", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 61 items -> 61", + "author": "OWASP GenAI Data Security Initiative" } ] } diff --git a/data/frameworks/eu-ai-act.json b/data/frameworks/eu-ai-act.json index 718d75c..e105906 100644 --- a/data/frameworks/eu-ai-act.json +++ b/data/frameworks/eu-ai-act.json @@ -256,6 +256,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 145 items -> 30", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 30 items -> 30", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { diff --git a/data/frameworks/iso-42001.json b/data/frameworks/iso-42001.json index 1771176..74480a5 100644 --- a/data/frameworks/iso-42001.json +++ b/data/frameworks/iso-42001.json @@ -439,6 +439,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 87 items -> 56", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 56 items -> 56", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { diff --git a/data/frameworks/nist-sp-800-218a.json b/data/frameworks/nist-sp-800-218a.json index 03bd7d2..e431d5a 100644 --- a/data/frameworks/nist-sp-800-218a.json +++ b/data/frameworks/nist-sp-800-218a.json @@ -95,6 +95,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 52 items -> 12", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 12 items -> 12", + "author": "OWASP GenAI Data Security Initiative" } ] } diff --git a/data/frameworks/nist-sp-800-82.json b/data/frameworks/nist-sp-800-82.json index 7c10115..fd1a89e 100644 --- a/data/frameworks/nist-sp-800-82.json +++ b/data/frameworks/nist-sp-800-82.json @@ -205,6 +205,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 59 items -> 26", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 26 items -> 26", + "author": "OWASP GenAI Data Security Initiative" } ] } diff --git a/data/frameworks/owasp-ai-testing.json b/data/frameworks/owasp-ai-testing.json index b664719..e91dd04 100644 --- a/data/frameworks/owasp-ai-testing.json +++ b/data/frameworks/owasp-ai-testing.json @@ -86,6 +86,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 58 items -> 9", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 9 items -> 9", + "author": "OWASP GenAI Data Security Initiative" } ] } diff --git a/data/frameworks/owasp-asvs.json b/data/frameworks/owasp-asvs.json index 5812b51..50e0d00 100644 --- a/data/frameworks/owasp-asvs.json +++ b/data/frameworks/owasp-asvs.json @@ -26,6 +26,18 @@ "function": "Architecture", "kind": "control" }, + { + "control_id": "V1.1.2", + "title": "Threat modelling of all data flows", + "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented", + "kind": "control" + }, + { + "control_id": "V1.1.4", + "title": "Trust boundaries documented and enforced", + "kind": "control", + "parent": "V1" + }, { "control_id": "V1.2", "title": "Authentication Architecture", @@ -66,6 +78,12 @@ "function": "Verification", "kind": "control" }, + { + "control_id": "V2.1.1", + "title": "Verify credentials not in source code", + "description": "Agent credentials not hardcoded — secret manager required", + "kind": "control" + }, { "control_id": "V2.5", "title": "Credential Recovery", @@ -82,6 +100,13 @@ "function": "Verification", "kind": "control" }, + { + "control_id": "V2.10.1", + "title": "Integration secrets not hardcoded", + "description": "", + "parent": "V2", + "kind": "control" + }, { "control_id": "V3", "title": "Session Management", @@ -90,6 +115,18 @@ "function": "Verification", "kind": "control" }, + { + "control_id": "V3.1.1", + "title": "Session tokens unique and random", + "kind": "control", + "parent": "V3" + }, + { + "control_id": "V3.3.1", + "title": "Verify anti-replay tokens in state-changing operations", + "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", + "kind": "control" + }, { "control_id": "V4", "title": "Access Control", @@ -106,6 +143,32 @@ "function": "Verification", "kind": "control" }, + { + "control_id": "V4.1.1", + "title": "Verify all sensitive functions have access control", + "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "kind": "control" + }, + { + "control_id": "V4.1.2", + "title": "Least privilege for service accounts", + "description": "", + "parent": "V4", + "kind": "control" + }, + { + "control_id": "V4.1.3", + "title": "Verify access control enforces least privilege", + "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write", + "kind": "control" + }, + { + "control_id": "V4.1.5", + "title": "Access control failures logged", + "description": "", + "parent": "V4", + "kind": "control" + }, { "control_id": "V4.2", "title": "Operation Level Access Control", @@ -114,6 +177,12 @@ "function": "Verification", "kind": "control" }, + { + "control_id": "V4.2.2", + "title": "Verify anti-CSRF tokens in state-changing operations", + "description": "CSRF protection on endpoints where LLM output triggers state changes", + "kind": "control" + }, { "control_id": "V5", "title": "Validation, Sanitization and Encoding", @@ -130,6 +199,25 @@ "function": "Verification", "kind": "control" }, + { + "control_id": "V5.1.1", + "title": "Verify all user input validated against allowlist", + "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope", + "kind": "control" + }, + { + "control_id": "V5.1.2", + "title": "Verify that HTTP request parts are validated, sanitised, or rejected", + "description": "LLM API request validation — prompt structure, content type, and character set enforced", + "kind": "control" + }, + { + "control_id": "V5.1.3", + "title": "Input validation server-side", + "description": "", + "parent": "V5", + "kind": "control" + }, { "control_id": "V5.2", "title": "Sanitization and Sandboxing", @@ -138,6 +226,37 @@ "function": "Verification", "kind": "control" }, + { + "control_id": "V5.2.1", + "title": "Verify output encoding prevents injection", + "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", + "kind": "control" + }, + { + "control_id": "V5.2.4", + "title": "Verify application does not use eval or dynamic code", + "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", + "kind": "control" + }, + { + "control_id": "V5.2.5", + "title": "Verify application protects against OS command injection", + "description": "Agent-generated instructions not executed in system context without validation; Agent-generated commands validated before any shell execution; LLM-generated content validated before execution in any shell or interpreter context", + "kind": "control" + }, + { + "control_id": "V5.2.6", + "title": "Defined output structure", + "description": "", + "parent": "V5", + "kind": "control" + }, + { + "control_id": "V5.2.8", + "title": "Output encoding for context", + "kind": "control", + "parent": "V5" + }, { "control_id": "V5.3", "title": "Output Encoding and Injection Prevention", @@ -146,6 +265,19 @@ "function": "Verification", "kind": "control" }, + { + "control_id": "V5.3.4", + "title": "SQL injection prevention", + "description": "", + "parent": "V5", + "kind": "control" + }, + { + "control_id": "V5.3.5", + "title": "Verify output encoding in SQL context", + "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context", + "kind": "control" + }, { "control_id": "V5.5", "title": "Deserialization Prevention", @@ -162,6 +294,12 @@ "function": "Verification", "kind": "control" }, + { + "control_id": "V6.1.1", + "title": "Verify sensitive data encrypted at rest", + "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", + "kind": "control" + }, { "control_id": "V7", "title": "Error Handling and Logging", @@ -179,169 +317,136 @@ "kind": "control" }, { - "control_id": "V7.2", - "title": "Log Processing", - "description": "Verify that logs are processed securely.", + "control_id": "V7.1.1", + "title": "No credential logging", + "description": "", "parent": "V7", - "function": "Verification", - "kind": "control" - }, - { - "control_id": "V8", - "title": "Data Protection", - "description": "Verify that data is protected in transit and at rest.", - "parent": null, - "function": "Verification", "kind": "control" }, { - "control_id": "V8.1", - "title": "General Data Protection", - "description": "Verify sensitive data is identified and protected.", - "parent": "V8", - "function": "Verification", - "kind": "control" - }, - { - "control_id": "V8.3", - "title": "Sensitive Private Data", - "description": "Verify that sensitive data is protected from unauthorized access.", - "parent": "V8", - "function": "Verification", + "control_id": "V7.1.2", + "title": "No sensitive data in logs", + "description": "", + "parent": "V7", "kind": "control" }, { - "control_id": "V9", - "title": "Communication", - "description": "Verify that communications are encrypted using TLS.", - "parent": null, + "control_id": "V7.2", + "title": "Log Processing", + "description": "Verify that logs are processed securely.", + "parent": "V7", "function": "Verification", "kind": "control" }, { - "control_id": "V10", - "title": "Malicious Code", - "description": "Verify that code does not contain malicious logic.", - "parent": null, - "function": "Verification", + "control_id": "V7.2.1", + "title": "Verify access control decisions logged", + "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability", "kind": "control" }, { - "control_id": "V11", - "title": "Business Logic", - "description": "Verify that business logic flows are sequential and audited.", - "parent": null, - "function": "Verification", + "control_id": "V7.2.2", + "title": "Verify all business logic decisions logged", + "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable", "kind": "control" }, { - "control_id": "V12", - "title": "Files and Resources", - "description": "Verify that untrusted files and resources are handled safely.", - "parent": null, - "function": "Verification", + "control_id": "V7.4.1", + "title": "Verify error handling does not expose sensitive data", + "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", "kind": "control" }, { - "control_id": "V13", - "title": "API and Web Service", - "description": "Verify that API and web service requests are validated.", + "control_id": "V8", + "title": "Data Protection", + "description": "Verify that data is protected in transit and at rest.", "parent": null, "function": "Verification", "kind": "control" }, { - "control_id": "V13.1", - "title": "Generic Web Service Security", - "description": "Verify that all API and web service interactions are authenticated and authorized.", - "parent": "V13", - "function": "Verification", - "kind": "control" - }, - { - "control_id": "V14", - "title": "Configuration", - "description": "Verify that the application is securely configured.", - "parent": null, + "control_id": "V8.1", + "title": "General Data Protection", + "description": "Verify sensitive data is identified and protected.", + "parent": "V8", "function": "Verification", "kind": "control" }, { - "control_id": "V5.1.1", - "title": "Verify all user input validated against allowlist", - "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope", - "kind": "control" - }, - { - "control_id": "V5.2.1", - "title": "Verify output encoding prevents injection", - "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", - "kind": "control" - }, - { - "control_id": "V5.2.5", - "title": "Verify application protects against OS command injection", - "description": "Agent-generated instructions not executed in system context without validation; Agent-generated commands validated before any shell execution; LLM-generated content validated before execution in any shell or interpreter context", + "control_id": "V8.1.1", + "title": "Verify sensitive data is not cached or exposed in logs", + "description": "LLM outputs containing sensitive data not logged in cleartext or cached without protection; System prompts not stored in cleartext application configuration or source code", "kind": "control" }, { - "control_id": "V1.1.2", - "title": "Threat modelling of all data flows", - "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented", + "control_id": "V8.1.3", + "title": "Sensitive data not in session storage", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V11.1.2", - "title": "Verify business logic limits prevent function abuse", - "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", + "control_id": "V8.1.4", + "title": "Sensitive data minimisation", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V4.1.3", - "title": "Verify access control enforces least privilege", - "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write", + "control_id": "V8.3", + "title": "Sensitive Private Data", + "description": "Verify that sensitive data is protected from unauthorized access.", + "parent": "V8", + "function": "Verification", "kind": "control" }, { - "control_id": "V4.1.1", - "title": "Verify all sensitive functions have access control", - "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "control_id": "V8.3.3", + "title": "Consent obtained before PI processing", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V7.2.2", - "title": "Verify all business logic decisions logged", - "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable", + "control_id": "V8.3.4", + "title": "Verify PII is identified and protected", + "description": "PII in LLM training data, RAG sources, and outputs identified and handled per policy", "kind": "control" }, { - "control_id": "V13.1.1", - "title": "Verify API rate limiting", - "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", + "control_id": "V8.3.7", + "title": "Data transferred using current TLS", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V2.1.1", - "title": "Verify credentials not in source code", - "description": "Agent credentials not hardcoded — secret manager required", + "control_id": "V8.3.10", + "title": "Personal data not kept longer than needed", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V6.1.1", - "title": "Verify sensitive data encrypted at rest", - "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", + "control_id": "V9", + "title": "Communication", + "description": "Verify that communications are encrypted using TLS.", + "parent": null, + "function": "Verification", "kind": "control" }, { - "control_id": "V7.2.1", - "title": "Verify access control decisions logged", - "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability", + "control_id": "V9.1.1", + "title": "Verify TLS used for all client connectivity", + "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", "kind": "control" }, { - "control_id": "V14.2.3", - "title": "Verify secrets not in source code", - "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system", + "control_id": "V10", + "title": "Malicious Code", + "description": "Verify that code does not contain malicious logic.", + "parent": null, + "function": "Verification", "kind": "control" }, { @@ -357,39 +462,11 @@ "kind": "control" }, { - "control_id": "V14.2.2", - "title": "Verify build pipelines include security checks", - "description": "CI/CD pipeline for agent components includes integrity verification and CVE scanning; CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning", - "kind": "control" - }, - { - "control_id": "V5.2.4", - "title": "Verify application does not use eval or dynamic code", - "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", - "kind": "control" - }, - { - "control_id": "V5.3.5", - "title": "Verify output encoding in SQL context", - "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context", - "kind": "control" - }, - { - "control_id": "V12.1.1", - "title": "Verify file upload malware scanning", - "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected", - "kind": "control" - }, - { - "control_id": "V9.1.1", - "title": "Verify TLS used for all client connectivity", - "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", - "kind": "control" - }, - { - "control_id": "V3.3.1", - "title": "Verify anti-replay tokens in state-changing operations", - "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", + "control_id": "V11", + "title": "Business Logic", + "description": "Verify that business logic flows are sequential and audited.", + "parent": null, + "function": "Verification", "kind": "control" }, { @@ -399,115 +476,111 @@ "kind": "control" }, { - "control_id": "V7.4.1", - "title": "Verify error handling does not expose sensitive data", - "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", - "kind": "control" - }, - { - "control_id": "V13.1.3", - "title": "Verify API rejects large unexpected payloads", - "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", - "kind": "control" - }, - { - "control_id": "V8 Data Protection", - "title": "V8.1.1 — Sensitive data not transmitted in URL parameters", - "kind": "control" - }, - { - "control_id": "V4 Access Control", - "title": "V4.1.3 — Deny by default access control", - "kind": "control" - }, - { - "control_id": "V5 Validation", - "title": "V5.2.8 — Output encoding for context", - "kind": "control" - }, - { - "control_id": "V6 Cryptography", - "title": "V6.1.1 — Sensitive data not stored in cleartext", + "control_id": "V11.1.2", + "title": "Verify business logic limits prevent function abuse", + "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", "kind": "control" }, { - "control_id": "V2 Authentication", - "title": "V2.1.1 — Passwords minimum 12 characters", + "control_id": "V11.1.4", + "title": "Verify business logic rate limits", + "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", "kind": "control" }, { - "control_id": "V1 Architecture", - "title": "V1.1.4 — Trust boundaries documented and enforced", + "control_id": "V11.1.5", + "title": "Business logic prevents excess data access", + "description": "", + "parent": "V11", "kind": "control" }, { - "control_id": "V7 Logging", - "title": "V7.2.2 — Log entries contain required information", + "control_id": "V11.1.7", + "title": "Anti-automation controls", + "description": "", + "parent": "V11", "kind": "control" }, { - "control_id": "V14 Configuration", - "title": "V14.1.4 — All components inventoried", + "control_id": "V12", + "title": "Files and Resources", + "description": "Verify that untrusted files and resources are handled safely.", + "parent": null, + "function": "Verification", "kind": "control" }, { - "control_id": "V10 Malicious Code", - "title": "V10.2.1 — Application only uses official repositories", + "control_id": "V12.1.1", + "title": "Verify file upload malware scanning", + "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected", "kind": "control" }, { - "control_id": "V12 Files/Resources", - "title": "V12.1.1 — File upload size limits", + "control_id": "V12.1.3", + "title": "Malicious file detection on upload", + "description": "", + "parent": "V12", "kind": "control" }, { - "control_id": "V9 Communication", - "title": "V9.1.1 — TLS for all connections", + "control_id": "V13", + "title": "API and Web Service", + "description": "Verify that API and web service requests are validated.", + "parent": null, + "function": "Verification", "kind": "control" }, { - "control_id": "V11 Business Logic", - "title": "V11.1.4 — Business logic limits on repeated actions", + "control_id": "V13.1", + "title": "Generic Web Service Security", + "description": "Verify that all API and web service interactions are authenticated and authorized.", + "parent": "V13", + "function": "Verification", "kind": "control" }, { - "control_id": "V3 Session Management", - "title": "V3.1.1 — Session tokens unique and random", + "control_id": "V13.1.1", + "title": "Verify API rate limiting", + "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", "kind": "control" }, { - "control_id": "V13 API", - "title": "V13.1.1 — API protection against enumeration", + "control_id": "V13.1.2", + "title": "API throttling", + "description": "", + "parent": "V13", "kind": "control" }, { - "control_id": "V5.1.2", - "title": "Verify that HTTP request parts are validated, sanitised, or rejected", - "description": "LLM API request validation — prompt structure, content type, and character set enforced", + "control_id": "V13.1.3", + "title": "Verify API rejects large unexpected payloads", + "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", "kind": "control" }, { - "control_id": "V8.1.1", - "title": "Verify sensitive data is not cached or exposed in logs", - "description": "LLM outputs containing sensitive data not logged in cleartext or cached without protection; System prompts not stored in cleartext application configuration or source code", + "control_id": "V14", + "title": "Configuration", + "description": "Verify that the application is securely configured.", + "parent": null, + "function": "Verification", "kind": "control" }, { - "control_id": "V8.3.4", - "title": "Verify PII is identified and protected", - "description": "PII in LLM training data, RAG sources, and outputs identified and handled per policy", - "kind": "control" + "control_id": "V14.1.4", + "title": "All components inventoried", + "kind": "control", + "parent": "V14" }, { - "control_id": "V4.2.2", - "title": "Verify anti-CSRF tokens in state-changing operations", - "description": "CSRF protection on endpoints where LLM output triggers state changes", + "control_id": "V14.2.2", + "title": "Verify build pipelines include security checks", + "description": "CI/CD pipeline for agent components includes integrity verification and CVE scanning; CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning", "kind": "control" }, { - "control_id": "V11.1.4", - "title": "Verify business logic rate limits", - "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", + "control_id": "V14.2.3", + "title": "Verify secrets not in source code", + "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system", "kind": "control" } ], @@ -516,11 +589,16 @@ "date": "2026-04-09", "change": "Initial seed — 32 ASVS verification requirements and sub-requirements", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 75 items -> 82, including 17 referenced by mappings but absent from the registry", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { "status": "unknown", - "included": 75, + "included": 82, "total": null, "note": "Authoritative control count not established. Needs a count from the published framework.", "source": "https://owasp.org/projects/asvs" diff --git a/data/frameworks/owasp-nhi.json b/data/frameworks/owasp-nhi.json index 1b0991f..25046ac 100644 --- a/data/frameworks/owasp-nhi.json +++ b/data/frameworks/owasp-nhi.json @@ -98,6 +98,11 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 104 items -> 10", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 10 items -> 10", + "author": "OWASP GenAI Data Security Initiative" } ] } diff --git a/data/frameworks/pci-dss.json b/data/frameworks/pci-dss.json index a0e3e82..0dc2633 100644 --- a/data/frameworks/pci-dss.json +++ b/data/frameworks/pci-dss.json @@ -339,6 +339,11 @@ "date": "2026-09-18", "change": "Titled 17 entries that had carried only their identifier, from the published text: PCI DSS v4.0 requirement headings, transcribed from PCI SSC \"PCI DSS v4.0 SAQ D for Merchants\" — Req 1.3, Req 2.2, Req 3.4, Req 3.5, Req 4.2, Req 5.2, Req 6.3, Req 6.4, Req 7.2, Req 7.3, Req 8.2, Req 8.3, Req 10.2, Req 10.7, Req 11.3, Req 12.3, Req 12.6", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 49 items -> 49", + "author": "OWASP GenAI Data Security Initiative" } ] } diff --git a/data/frameworks/soc2.json b/data/frameworks/soc2.json index 6b2c4ac..e5e00ad 100644 --- a/data/frameworks/soc2.json +++ b/data/frameworks/soc2.json @@ -386,6 +386,11 @@ "date": "2026-09-18", "change": "Titled 2 entries that had carried only their identifier, from the published text: TSP section 100, 2017 Trust Services Criteria (with Revised Points of Focus — 2022) — P7.1, PI1.3", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 46 items -> 46", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { diff --git a/data/stats.json b/data/stats.json index 9ccfa54..d6b91d2 100644 --- a/data/stats.json +++ b/data/stats.json @@ -93,10 +93,10 @@ ] }, "controls": { - "total": 991, - "registry_items": 1125, + "total": 998, + "registry_items": 1132, "by_kind": { - "control": 991, + "control": 998, "layer": 10, "technique": 57, "threat-category": 6, diff --git a/docs/backlinks.js b/docs/backlinks.js index 5f293e2..598e195 100644 --- a/docs/backlinks.js +++ b/docs/backlinks.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Backlinks: 766 +// Backlinks: 773 window.CROSSWALK_BACKLINKS = [ { "framework": "AIUC-1", @@ -30528,31 +30528,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V1 Architecture", - "control_name": "V1.1.4 — Trust boundaries documented and enforced", - "entries": [ - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - } - ] - }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V1.1.2", @@ -30584,29 +30559,29 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Supply chain threat model documents all agent component sources and trust levels" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10 Malicious Code", - "control_name": "V10.2.1 — Application only uses official repositories", + "control_id": "V1.1.4", + "control_name": "Trust boundaries documented and enforced", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", "notes": null } @@ -30643,6 +30618,15 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, @@ -30668,44 +30652,19 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Approved component list — unsigned or unverified agent components rejected" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.4 — Business logic limits on repeated actions", - "entries": [ - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", "notes": null }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", @@ -30831,35 +30790,51 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V12 Files/Resources", - "control_name": "V12.1.1 — File upload size limits", - "entries": [ + }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V11.1.5", + "control_name": "Business logic prevents excess data access", + "entries": [ { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V11.1.7", + "control_name": "Anti-automation controls", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -30899,26 +30874,19 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V13 API", - "control_name": "V13.1.1 — API protection against enumeration", - "entries": [ + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", - "scope": "Build", + "tier": "Hardening", + "scope": "Both", "notes": null }, { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -30927,6 +30895,22 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V12.1.3", + "control_name": "Malicious file detection on upload", + "entries": [ + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V13.1.1", @@ -30967,6 +30951,31 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V13.1.2", + "control_name": "API throttling", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, @@ -30997,8 +31006,8 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14 Configuration", - "control_name": "V14.1.4 — All components inventoried", + "control_id": "V14.1.4", + "control_name": "All components inventoried", "entries": [ { "id": "DSGAI03", @@ -31063,9 +31072,18 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2 Authentication", - "control_name": "V2.1.1 — Passwords minimum 12 characters", + "control_id": "V2.1.1", + "control_name": "Verify credentials not in source code", "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credentials not hardcoded — secret manager required" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -31088,24 +31106,24 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", - "control_name": "Verify credentials not in source code", + "control_id": "V2.10.1", + "control_name": "Integration secrets not hardcoded", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials not hardcoded — secret manager required" + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3 Session Management", - "control_name": "V3.1.1 — Session tokens unique and random", + "control_id": "V3.1.1", + "control_name": "Session tokens unique and random", "entries": [ { "id": "DSGAI11", @@ -31140,40 +31158,40 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.3 — Deny by default access control", + "control_id": "V4.1.1", + "control_name": "Verify all sensitive functions have access control", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - }, - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null + "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session" }, { "id": "DSGAI06", @@ -31185,21 +31203,12 @@ window.CROSSWALK_BACKLINKS = [ "notes": null }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", + "scope": "Build", "notes": null }, { @@ -31211,15 +31220,6 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Build", "notes": null }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, { "id": "DSGAI14", "name": "Excessive Telemetry and Monitoring Leakage", @@ -31230,12 +31230,28 @@ window.CROSSWALK_BACKLINKS = [ "notes": null }, { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V4.1.2", + "control_name": "Least privilege for service accounts", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { @@ -31255,40 +31271,6 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": null - }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", - "control_name": "Verify all sensitive functions have access control", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session" } ] }, @@ -31368,30 +31350,7 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "A2A channels enforce sender identity — unauthenticated messages rejected" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.2.2", - "control_name": "Verify anti-CSRF tokens in state-changing operations", - "entries": [ - { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "CSRF protection on endpoints where LLM output triggers state changes" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.8 — Output encoding for context", - "entries": [ + }, { "id": "DSGAI01", "name": "Sensitive Data Leakage", @@ -31402,58 +31361,63 @@ window.CROSSWALK_BACKLINKS = [ "notes": null }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Build", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V4.1.5", + "control_name": "Access control failures logged", + "entries": [ { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V4.2.2", + "control_name": "Verify anti-CSRF tokens in state-changing operations", + "entries": [ { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "CSRF protection on endpoints where LLM output triggers state changes" } ] }, @@ -31497,6 +31461,24 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "All content entering agent memory validated — injection patterns rejected at write boundary" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, @@ -31516,6 +31498,31 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V5.1.3", + "control_name": "Input validation server-side", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V5.2.1", @@ -31574,6 +31581,15 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, @@ -31642,6 +31658,63 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Agent-generated commands validated before any shell execution" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V5.2.6", + "control_name": "Defined output structure", + "entries": [ + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V5.2.8", + "control_name": "Output encoding for context", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V5.3.4", + "control_name": "SQL injection prevention", + "entries": [ + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, @@ -31670,40 +31743,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V6 Cryptography", - "control_name": "V6.1.1 — Sensitive data not stored in cleartext", - "entries": [ - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V6.1.1", @@ -31744,41 +31783,57 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.2.2 — Log entries contain required information", - "entries": [ + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V7.1.1", + "control_name": "No credential logging", + "entries": [ + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V7.1.2", + "control_name": "No sensitive data in logs", + "entries": [ { "id": "DSGAI14", "name": "Excessive Telemetry and Monitoring Leakage", @@ -31864,6 +31919,24 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, @@ -31907,84 +31980,98 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.1 — Sensitive data not transmitted in URL parameters", + "control_id": "V8.1.1", + "control_name": "Verify sensitive data is not cached or exposed in logs", "entries": [ { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "System prompts not stored in cleartext application configuration or source code" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.1.3", + "control_name": "Sensitive data not in session storage", + "entries": [ { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "tier": "Foundational", "scope": "Build", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.1.4", + "control_name": "Sensitive data minimisation", + "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Foundational", - "scope": "Build", + "tier": "Hardening", + "scope": "Both", "notes": null }, { @@ -31997,29 +32084,27 @@ window.CROSSWALK_BACKLINKS = [ "notes": null }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", "scope": "Both", "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V8.3.10", + "control_name": "Personal data not kept longer than needed", + "entries": [ { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", "notes": null } @@ -32027,26 +32112,26 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data is not cached or exposed in logs", + "control_id": "V8.3.3", + "control_name": "Consent obtained before PI processing", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" + "notes": null }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": "System prompts not stored in cleartext application configuration or source code" + "notes": null } ] }, @@ -32063,19 +32148,55 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9 Communication", - "control_name": "V9.1.1 — TLS for all connections", + "control_id": "V8.3.7", + "control_name": "Data transferred using current TLS", "entries": [ { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null @@ -32104,6 +32225,15 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null } ] }, diff --git a/docs/data.js b/docs/data.js index a1b806c..ae85b24 100644 --- a/docs/data.js +++ b/docs/data.js @@ -25352,46 +25352,51 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.1 — Sensitive data not transmitted in URL parameters", + "control_id": "V8.1.1", + "control_name": "Sensitive data not transmitted in URL parameters", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.4 — Sensitive data identified and classified", + "control_id": "V8.3.4", + "control_name": "Sensitive data identified and classified", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.3 — Deny by default access control", + "control_id": "V4.1.3", + "control_name": "Deny by default access control", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.8 — Output encoding for context", + "control_id": "V5.2.8", + "control_name": "Output encoding for context", "tier": "Foundational", "scope": "Both", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6 Cryptography", - "control_name": "V6.1.1 — Sensitive data not stored in cleartext", + "control_id": "V6.1.1", + "control_name": "Sensitive data not stored in cleartext", "tier": "Foundational", "scope": "Both", + "parent": "V6", "confidence": "unreviewed", "reviewed_by": [] }, @@ -26554,37 +26559,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2 Authentication", - "control_name": "V2.1.1 — Passwords minimum 12 characters", + "control_id": "V2.1.1", + "control_name": "Passwords minimum 12 characters", "tier": "Foundational", "scope": "Both", + "parent": "V2", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2 Authentication", - "control_name": "V2.10.1 — Integration secrets not hardcoded", + "control_id": "V2.10.1", + "control_name": "Integration secrets not hardcoded", "tier": "Foundational", "scope": "Both", + "parent": "V2", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.2 — Least privilege for service accounts", + "control_id": "V4.1.2", + "control_name": "Least privilege for service accounts", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.7 — Data transferred using current TLS", + "control_id": "V8.3.7", + "control_name": "Data transferred using current TLS", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, @@ -27620,37 +27629,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V1 Architecture", - "control_name": "V1.1.4 — Trust boundaries documented and enforced", + "control_id": "V1.1.4", + "control_name": "Trust boundaries documented and enforced", "tier": "Foundational", "scope": "Both", + "parent": "V1", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.5 — Access control failures logged", + "control_id": "V4.1.5", + "control_name": "Access control failures logged", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.2.2 — Log entries contain required information", + "control_id": "V7.2.2", + "control_name": "Log entries contain required information", "tier": "Foundational", "scope": "Both", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14 Configuration", - "control_name": "V14.1.4 — All components inventoried", + "control_id": "V14.1.4", + "control_name": "All components inventoried", "tier": "Foundational", "scope": "Both", + "parent": "V14", "confidence": "unreviewed", "reviewed_by": [] }, @@ -28599,37 +28612,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.1.3 — Input validation server-side", + "control_id": "V5.1.3", + "control_name": "Input validation server-side", "tier": "Hardening", "scope": "Both", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10 Malicious Code", - "control_name": "V10.2.1 — Application only uses official repositories", + "control_id": "V10.2.1", + "control_name": "Application only uses official repositories", "tier": "Hardening", "scope": "Both", + "parent": "V10", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10 Malicious Code", - "control_name": "V10.2.2 — Dependency managers check for vulnerabilities", + "control_id": "V10.2.2", + "control_name": "Dependency managers check for vulnerabilities", "tier": "Hardening", "scope": "Both", + "parent": "V10", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12 Files/Resources", - "control_name": "V12.1.1 — File upload size limits", + "control_id": "V12.1.1", + "control_name": "File upload size limits", "tier": "Hardening", "scope": "Both", + "parent": "V12", "confidence": "unreviewed", "reviewed_by": [] }, @@ -29682,28 +29699,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.1.1 — Input validation using allowlists", + "control_id": "V5.1.1", + "control_name": "Input validation using allowlists", "tier": "Foundational", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.1 — HTML/JS output sanitised", + "control_id": "V5.2.1", + "control_name": "HTML/JS output sanitised", "tier": "Foundational", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.4.1 — Generic error messages", + "control_id": "V7.4.1", + "control_name": "Generic error messages", "tier": "Foundational", "scope": "Build", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, @@ -30734,28 +30754,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control on every request", + "control_id": "V4.1.1", + "control_name": "Access control on every request", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9 Communication", - "control_name": "V9.1.1 — TLS for all connections", + "control_id": "V9.1.1", + "control_name": "TLS for all connections", "tier": "Foundational", "scope": "Both", + "parent": "V9", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.4 — Business logic limits on repeated actions", + "control_id": "V11.1.4", + "control_name": "Business logic limits on repeated actions", "tier": "Foundational", "scope": "Both", + "parent": "V11", "confidence": "unreviewed", "reviewed_by": [] }, @@ -31722,28 +31745,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.4 — Sensitive data minimisation", + "control_id": "V8.1.4", + "control_name": "Sensitive data minimisation", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.4 — Sensitive data identified and classified", + "control_id": "V8.3.4", + "control_name": "Sensitive data identified and classified", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.5 — Attribute-based access control", + "control_id": "V4.1.5", + "control_name": "Attribute-based access control", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, @@ -32694,28 +32720,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.3 — Consent obtained before PI processing", + "control_id": "V8.3.3", + "control_name": "Consent obtained before PI processing", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.10 — Personal data not kept longer than needed", + "control_id": "V8.3.10", + "control_name": "Personal data not kept longer than needed", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.2.2 — Audit trail sufficient for compliance", + "control_id": "V7.2.2", + "control_name": "Audit trail sufficient for compliance", "tier": "Foundational", "scope": "Both", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, @@ -33773,28 +33802,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.5 — Unstructured data sanitised", + "control_id": "V5.2.5", + "control_name": "Unstructured data sanitised", "tier": "Hardening", "scope": "Both", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.4 — Sensitive data minimised", + "control_id": "V8.1.4", + "control_name": "Sensitive data minimised", "tier": "Hardening", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12 Files/Resources", - "control_name": "V12.1.3 — Malicious file detection on upload", + "control_id": "V12.1.3", + "control_name": "Malicious file detection on upload", "tier": "Hardening", "scope": "Both", + "parent": "V12", "confidence": "unreviewed", "reviewed_by": [] }, @@ -34738,19 +34770,21 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.4 — Sensitive data classified", + "control_id": "V8.3.4", + "control_name": "Sensitive data classified", "tier": "Hardening", "scope": "Build", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.2.6 — Defined output structure", + "control_id": "V5.2.6", + "control_name": "Defined output structure", "tier": "Hardening", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, @@ -35657,37 +35691,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3 Session Management", - "control_name": "V3.1.1 — Session tokens unique and random", + "control_id": "V3.1.1", + "control_name": "Session tokens unique and random", "tier": "Foundational", "scope": "Build", + "parent": "V3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3 Session Management", - "control_name": "V3.3.1 — Sessions invalidated after logout", + "control_id": "V3.3.1", + "control_name": "Sessions invalidated after logout", "tier": "Foundational", "scope": "Build", + "parent": "V3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control enforced on every request", + "control_id": "V4.1.1", + "control_name": "Access control enforced on every request", "tier": "Foundational", "scope": "Build", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.3 — Sensitive data not in session storage", + "control_id": "V8.1.3", + "control_name": "Sensitive data not in session storage", "tier": "Foundational", "scope": "Build", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, @@ -36632,37 +36670,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.1.1 — Allowlist input validation", + "control_id": "V5.1.1", + "control_name": "Allowlist input validation", "tier": "Foundational", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.3.4 — SQL injection prevention", + "control_id": "V5.3.4", + "control_name": "SQL injection prevention", "tier": "Foundational", "scope": "Build", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control on every request", + "control_id": "V4.1.1", + "control_name": "Access control on every request", "tier": "Foundational", "scope": "Build", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13 API", - "control_name": "V13.1.1 — API protection against enumeration", + "control_id": "V13.1.1", + "control_name": "API protection against enumeration", "tier": "Foundational", "scope": "Build", + "parent": "V13", "confidence": "unreviewed", "reviewed_by": [] }, @@ -37629,28 +37671,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.3 — Deny by default", + "control_id": "V4.1.3", + "control_name": "Deny by default", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6 Cryptography", - "control_name": "V6.1.1 — Sensitive data not stored in cleartext", + "control_id": "V6.1.1", + "control_name": "Sensitive data not stored in cleartext", "tier": "Foundational", "scope": "Both", + "parent": "V6", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12 Files/Resources", - "control_name": "V12.1.1 — File upload validation", + "control_id": "V12.1.1", + "control_name": "File upload validation", "tier": "Foundational", "scope": "Both", + "parent": "V12", "confidence": "unreviewed", "reviewed_by": [] }, @@ -38642,37 +38687,41 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.1.1 — No credential logging", + "control_id": "V7.1.1", + "control_name": "No credential logging", "tier": "Foundational", "scope": "Build", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7 Logging", - "control_name": "V7.1.2 — No sensitive data in logs", + "control_id": "V7.1.2", + "control_name": "No sensitive data in logs", "tier": "Foundational", "scope": "Build", + "parent": "V7", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.1 — Sensitive data not in URLs", + "control_id": "V8.1.1", + "control_name": "Sensitive data not in URLs", "tier": "Foundational", "scope": "Build", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control on log stores", + "control_id": "V4.1.1", + "control_name": "Access control on log stores", "tier": "Foundational", "scope": "Build", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, @@ -39658,28 +39707,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.3 — Deny by default access control", + "control_id": "V4.1.3", + "control_name": "Deny by default access control", "tier": "Foundational", "scope": "Build", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.4 — Data minimisation", + "control_id": "V8.1.4", + "control_name": "Data minimisation", "tier": "Foundational", "scope": "Build", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3 Session Management", - "control_name": "V3.1.1 — Session isolation", + "control_id": "V3.1.1", + "control_name": "Session isolation", "tier": "Foundational", "scope": "Build", + "parent": "V3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -40620,28 +40672,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.2 — Least privilege", + "control_id": "V4.1.2", + "control_name": "Least privilege", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.5 — Business logic prevents excess data access", + "control_id": "V11.1.5", + "control_name": "Business logic prevents excess data access", "tier": "Foundational", "scope": "Both", + "parent": "V11", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V1 Architecture", - "control_name": "V1.1.2 — Secure architecture and design", + "control_id": "V1.1.2", + "control_name": "Secure architecture and design", "tier": "Foundational", "scope": "Both", + "parent": "V1", "confidence": "unreviewed", "reviewed_by": [] }, @@ -41626,19 +41681,21 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.7 — Anti-automation controls", + "control_id": "V11.1.7", + "control_name": "Anti-automation controls", "tier": "Foundational", "scope": "Both", + "parent": "V11", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13 API", - "control_name": "V13.1.2 — API throttling", + "control_id": "V13.1.2", + "control_name": "API throttling", "tier": "Foundational", "scope": "Both", + "parent": "V13", "confidence": "unreviewed", "reviewed_by": [] }, @@ -42652,19 +42709,21 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.4 — Sensitive data identified", + "control_id": "V8.3.4", + "control_name": "Sensitive data identified", "tier": "Hardening", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6 Cryptography", - "control_name": "V6.1.1 — Sensitive data not stored in cleartext", + "control_id": "V6.1.1", + "control_name": "Sensitive data not stored in cleartext", "tier": "Hardening", "scope": "Both", + "parent": "V6", "confidence": "unreviewed", "reviewed_by": [] }, @@ -43553,28 +43612,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.2 — Least privilege", + "control_id": "V4.1.2", + "control_name": "Least privilege", "tier": "Foundational", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.3.3 — Consent for personal data processing", + "control_id": "V8.3.3", + "control_name": "Consent for personal data processing", "tier": "Foundational", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2 Authentication", - "control_name": "V2.1.1 — Strong authentication", + "control_id": "V2.1.1", + "control_name": "Strong authentication", "tier": "Foundational", "scope": "Both", + "parent": "V2", "confidence": "unreviewed", "reviewed_by": [] }, @@ -44510,28 +44572,31 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4 Access Control", - "control_name": "V4.1.1 — Access control per request", + "control_id": "V4.1.1", + "control_name": "Access control per request", "tier": "Hardening", "scope": "Both", + "parent": "V4", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8 Data Protection", - "control_name": "V8.1.4 — Data minimisation in responses", + "control_id": "V8.1.4", + "control_name": "Data minimisation in responses", "tier": "Hardening", "scope": "Both", + "parent": "V8", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10 Malicious Code", - "control_name": "V10.2.2 — Component integrity checking", + "control_id": "V10.2.2", + "control_name": "Component integrity checking", "tier": "Hardening", "scope": "Both", + "parent": "V10", "confidence": "unreviewed", "reviewed_by": [] }, @@ -45511,19 +45576,21 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5 Validation", - "control_name": "V5.1.3 — Server-side input validation", + "control_id": "V5.1.3", + "control_name": "Server-side input validation", "tier": "Hardening", "scope": "Both", + "parent": "V5", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11 Business Logic", - "control_name": "V11.1.4 — Enforce business logic limits", + "control_id": "V11.1.4", + "control_name": "Enforce business logic limits", "tier": "Hardening", "scope": "Both", + "parent": "V11", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/docs/frameworks-registry.js b/docs/frameworks-registry.js index cfc0ecd..b0c26b5 100644 --- a/docs/frameworks-registry.js +++ b/docs/frameworks-registry.js @@ -622,6 +622,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 70 items -> 68, including 14 referenced by mappings but absent from the registry", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 68 items -> 68", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { @@ -1315,6 +1320,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 76 items -> 61", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 61 items -> 61", + "author": "OWASP GenAI Data Security Initiative" } ] }, @@ -2333,6 +2343,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 145 items -> 30", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 30 items -> 30", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { @@ -3745,6 +3760,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 87 items -> 56", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 56 items -> 56", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { @@ -5639,6 +5659,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 52 items -> 12", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 12 items -> 12", + "author": "OWASP GenAI Data Security Initiative" } ] }, @@ -5849,6 +5874,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 59 items -> 26", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 26 items -> 26", + "author": "OWASP GenAI Data Security Initiative" } ] }, @@ -5940,6 +5970,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 58 items -> 9", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 9 items -> 9", + "author": "OWASP GenAI Data Security Initiative" } ] }, @@ -7723,6 +7758,18 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Architecture", "kind": "control" }, + { + "control_id": "V1.1.2", + "title": "Threat modelling of all data flows", + "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented", + "kind": "control" + }, + { + "control_id": "V1.1.4", + "title": "Trust boundaries documented and enforced", + "kind": "control", + "parent": "V1" + }, { "control_id": "V1.2", "title": "Authentication Architecture", @@ -7763,6 +7810,12 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Verification", "kind": "control" }, + { + "control_id": "V2.1.1", + "title": "Verify credentials not in source code", + "description": "Agent credentials not hardcoded — secret manager required", + "kind": "control" + }, { "control_id": "V2.5", "title": "Credential Recovery", @@ -7779,6 +7832,13 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Verification", "kind": "control" }, + { + "control_id": "V2.10.1", + "title": "Integration secrets not hardcoded", + "description": "", + "parent": "V2", + "kind": "control" + }, { "control_id": "V3", "title": "Session Management", @@ -7787,6 +7847,18 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Verification", "kind": "control" }, + { + "control_id": "V3.1.1", + "title": "Session tokens unique and random", + "kind": "control", + "parent": "V3" + }, + { + "control_id": "V3.3.1", + "title": "Verify anti-replay tokens in state-changing operations", + "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", + "kind": "control" + }, { "control_id": "V4", "title": "Access Control", @@ -7803,6 +7875,32 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Verification", "kind": "control" }, + { + "control_id": "V4.1.1", + "title": "Verify all sensitive functions have access control", + "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "kind": "control" + }, + { + "control_id": "V4.1.2", + "title": "Least privilege for service accounts", + "description": "", + "parent": "V4", + "kind": "control" + }, + { + "control_id": "V4.1.3", + "title": "Verify access control enforces least privilege", + "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write", + "kind": "control" + }, + { + "control_id": "V4.1.5", + "title": "Access control failures logged", + "description": "", + "parent": "V4", + "kind": "control" + }, { "control_id": "V4.2", "title": "Operation Level Access Control", @@ -7811,6 +7909,12 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Verification", "kind": "control" }, + { + "control_id": "V4.2.2", + "title": "Verify anti-CSRF tokens in state-changing operations", + "description": "CSRF protection on endpoints where LLM output triggers state changes", + "kind": "control" + }, { "control_id": "V5", "title": "Validation, Sanitization and Encoding", @@ -7827,6 +7931,25 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Verification", "kind": "control" }, + { + "control_id": "V5.1.1", + "title": "Verify all user input validated against allowlist", + "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope", + "kind": "control" + }, + { + "control_id": "V5.1.2", + "title": "Verify that HTTP request parts are validated, sanitised, or rejected", + "description": "LLM API request validation — prompt structure, content type, and character set enforced", + "kind": "control" + }, + { + "control_id": "V5.1.3", + "title": "Input validation server-side", + "description": "", + "parent": "V5", + "kind": "control" + }, { "control_id": "V5.2", "title": "Sanitization and Sandboxing", @@ -7835,6 +7958,37 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Verification", "kind": "control" }, + { + "control_id": "V5.2.1", + "title": "Verify output encoding prevents injection", + "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", + "kind": "control" + }, + { + "control_id": "V5.2.4", + "title": "Verify application does not use eval or dynamic code", + "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", + "kind": "control" + }, + { + "control_id": "V5.2.5", + "title": "Verify application protects against OS command injection", + "description": "Agent-generated instructions not executed in system context without validation; Agent-generated commands validated before any shell execution; LLM-generated content validated before execution in any shell or interpreter context", + "kind": "control" + }, + { + "control_id": "V5.2.6", + "title": "Defined output structure", + "description": "", + "parent": "V5", + "kind": "control" + }, + { + "control_id": "V5.2.8", + "title": "Output encoding for context", + "kind": "control", + "parent": "V5" + }, { "control_id": "V5.3", "title": "Output Encoding and Injection Prevention", @@ -7843,6 +7997,19 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Verification", "kind": "control" }, + { + "control_id": "V5.3.4", + "title": "SQL injection prevention", + "description": "", + "parent": "V5", + "kind": "control" + }, + { + "control_id": "V5.3.5", + "title": "Verify output encoding in SQL context", + "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context", + "kind": "control" + }, { "control_id": "V5.5", "title": "Deserialization Prevention", @@ -7859,6 +8026,12 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Verification", "kind": "control" }, + { + "control_id": "V6.1.1", + "title": "Verify sensitive data encrypted at rest", + "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", + "kind": "control" + }, { "control_id": "V7", "title": "Error Handling and Logging", @@ -7876,169 +8049,136 @@ window.CROSSWALK_FRAMEWORKS = [ "kind": "control" }, { - "control_id": "V7.2", - "title": "Log Processing", - "description": "Verify that logs are processed securely.", + "control_id": "V7.1.1", + "title": "No credential logging", + "description": "", "parent": "V7", - "function": "Verification", - "kind": "control" - }, - { - "control_id": "V8", - "title": "Data Protection", - "description": "Verify that data is protected in transit and at rest.", - "parent": null, - "function": "Verification", - "kind": "control" - }, - { - "control_id": "V8.1", - "title": "General Data Protection", - "description": "Verify sensitive data is identified and protected.", - "parent": "V8", - "function": "Verification", "kind": "control" }, { - "control_id": "V8.3", - "title": "Sensitive Private Data", - "description": "Verify that sensitive data is protected from unauthorized access.", - "parent": "V8", - "function": "Verification", + "control_id": "V7.1.2", + "title": "No sensitive data in logs", + "description": "", + "parent": "V7", "kind": "control" }, { - "control_id": "V9", - "title": "Communication", - "description": "Verify that communications are encrypted using TLS.", - "parent": null, + "control_id": "V7.2", + "title": "Log Processing", + "description": "Verify that logs are processed securely.", + "parent": "V7", "function": "Verification", "kind": "control" }, { - "control_id": "V10", - "title": "Malicious Code", - "description": "Verify that code does not contain malicious logic.", - "parent": null, - "function": "Verification", + "control_id": "V7.2.1", + "title": "Verify access control decisions logged", + "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability", "kind": "control" }, { - "control_id": "V11", - "title": "Business Logic", - "description": "Verify that business logic flows are sequential and audited.", - "parent": null, - "function": "Verification", + "control_id": "V7.2.2", + "title": "Verify all business logic decisions logged", + "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable", "kind": "control" }, { - "control_id": "V12", - "title": "Files and Resources", - "description": "Verify that untrusted files and resources are handled safely.", - "parent": null, - "function": "Verification", + "control_id": "V7.4.1", + "title": "Verify error handling does not expose sensitive data", + "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", "kind": "control" }, { - "control_id": "V13", - "title": "API and Web Service", - "description": "Verify that API and web service requests are validated.", + "control_id": "V8", + "title": "Data Protection", + "description": "Verify that data is protected in transit and at rest.", "parent": null, "function": "Verification", "kind": "control" }, { - "control_id": "V13.1", - "title": "Generic Web Service Security", - "description": "Verify that all API and web service interactions are authenticated and authorized.", - "parent": "V13", - "function": "Verification", - "kind": "control" - }, - { - "control_id": "V14", - "title": "Configuration", - "description": "Verify that the application is securely configured.", - "parent": null, + "control_id": "V8.1", + "title": "General Data Protection", + "description": "Verify sensitive data is identified and protected.", + "parent": "V8", "function": "Verification", "kind": "control" }, { - "control_id": "V5.1.1", - "title": "Verify all user input validated against allowlist", - "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope", - "kind": "control" - }, - { - "control_id": "V5.2.1", - "title": "Verify output encoding prevents injection", - "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", - "kind": "control" - }, - { - "control_id": "V5.2.5", - "title": "Verify application protects against OS command injection", - "description": "Agent-generated instructions not executed in system context without validation; Agent-generated commands validated before any shell execution; LLM-generated content validated before execution in any shell or interpreter context", + "control_id": "V8.1.1", + "title": "Verify sensitive data is not cached or exposed in logs", + "description": "LLM outputs containing sensitive data not logged in cleartext or cached without protection; System prompts not stored in cleartext application configuration or source code", "kind": "control" }, { - "control_id": "V1.1.2", - "title": "Threat modelling of all data flows", - "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented", + "control_id": "V8.1.3", + "title": "Sensitive data not in session storage", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V11.1.2", - "title": "Verify business logic limits prevent function abuse", - "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", + "control_id": "V8.1.4", + "title": "Sensitive data minimisation", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V4.1.3", - "title": "Verify access control enforces least privilege", - "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write", + "control_id": "V8.3", + "title": "Sensitive Private Data", + "description": "Verify that sensitive data is protected from unauthorized access.", + "parent": "V8", + "function": "Verification", "kind": "control" }, { - "control_id": "V4.1.1", - "title": "Verify all sensitive functions have access control", - "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "control_id": "V8.3.3", + "title": "Consent obtained before PI processing", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V7.2.2", - "title": "Verify all business logic decisions logged", - "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable", + "control_id": "V8.3.4", + "title": "Verify PII is identified and protected", + "description": "PII in LLM training data, RAG sources, and outputs identified and handled per policy", "kind": "control" }, { - "control_id": "V13.1.1", - "title": "Verify API rate limiting", - "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", + "control_id": "V8.3.7", + "title": "Data transferred using current TLS", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V2.1.1", - "title": "Verify credentials not in source code", - "description": "Agent credentials not hardcoded — secret manager required", + "control_id": "V8.3.10", + "title": "Personal data not kept longer than needed", + "description": "", + "parent": "V8", "kind": "control" }, { - "control_id": "V6.1.1", - "title": "Verify sensitive data encrypted at rest", - "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", + "control_id": "V9", + "title": "Communication", + "description": "Verify that communications are encrypted using TLS.", + "parent": null, + "function": "Verification", "kind": "control" }, { - "control_id": "V7.2.1", - "title": "Verify access control decisions logged", - "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability", + "control_id": "V9.1.1", + "title": "Verify TLS used for all client connectivity", + "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", "kind": "control" }, { - "control_id": "V14.2.3", - "title": "Verify secrets not in source code", - "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system", + "control_id": "V10", + "title": "Malicious Code", + "description": "Verify that code does not contain malicious logic.", + "parent": null, + "function": "Verification", "kind": "control" }, { @@ -8054,39 +8194,11 @@ window.CROSSWALK_FRAMEWORKS = [ "kind": "control" }, { - "control_id": "V14.2.2", - "title": "Verify build pipelines include security checks", - "description": "CI/CD pipeline for agent components includes integrity verification and CVE scanning; CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning", - "kind": "control" - }, - { - "control_id": "V5.2.4", - "title": "Verify application does not use eval or dynamic code", - "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", - "kind": "control" - }, - { - "control_id": "V5.3.5", - "title": "Verify output encoding in SQL context", - "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context", - "kind": "control" - }, - { - "control_id": "V12.1.1", - "title": "Verify file upload malware scanning", - "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected", - "kind": "control" - }, - { - "control_id": "V9.1.1", - "title": "Verify TLS used for all client connectivity", - "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", - "kind": "control" - }, - { - "control_id": "V3.3.1", - "title": "Verify anti-replay tokens in state-changing operations", - "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", + "control_id": "V11", + "title": "Business Logic", + "description": "Verify that business logic flows are sequential and audited.", + "parent": null, + "function": "Verification", "kind": "control" }, { @@ -8096,115 +8208,111 @@ window.CROSSWALK_FRAMEWORKS = [ "kind": "control" }, { - "control_id": "V7.4.1", - "title": "Verify error handling does not expose sensitive data", - "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", - "kind": "control" - }, - { - "control_id": "V13.1.3", - "title": "Verify API rejects large unexpected payloads", - "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", - "kind": "control" - }, - { - "control_id": "V8 Data Protection", - "title": "V8.1.1 — Sensitive data not transmitted in URL parameters", - "kind": "control" - }, - { - "control_id": "V4 Access Control", - "title": "V4.1.3 — Deny by default access control", - "kind": "control" - }, - { - "control_id": "V5 Validation", - "title": "V5.2.8 — Output encoding for context", - "kind": "control" - }, - { - "control_id": "V6 Cryptography", - "title": "V6.1.1 — Sensitive data not stored in cleartext", + "control_id": "V11.1.2", + "title": "Verify business logic limits prevent function abuse", + "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", "kind": "control" }, { - "control_id": "V2 Authentication", - "title": "V2.1.1 — Passwords minimum 12 characters", + "control_id": "V11.1.4", + "title": "Verify business logic rate limits", + "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", "kind": "control" }, { - "control_id": "V1 Architecture", - "title": "V1.1.4 — Trust boundaries documented and enforced", + "control_id": "V11.1.5", + "title": "Business logic prevents excess data access", + "description": "", + "parent": "V11", "kind": "control" }, { - "control_id": "V7 Logging", - "title": "V7.2.2 — Log entries contain required information", + "control_id": "V11.1.7", + "title": "Anti-automation controls", + "description": "", + "parent": "V11", "kind": "control" }, { - "control_id": "V14 Configuration", - "title": "V14.1.4 — All components inventoried", + "control_id": "V12", + "title": "Files and Resources", + "description": "Verify that untrusted files and resources are handled safely.", + "parent": null, + "function": "Verification", "kind": "control" }, { - "control_id": "V10 Malicious Code", - "title": "V10.2.1 — Application only uses official repositories", + "control_id": "V12.1.1", + "title": "Verify file upload malware scanning", + "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected", "kind": "control" }, { - "control_id": "V12 Files/Resources", - "title": "V12.1.1 — File upload size limits", + "control_id": "V12.1.3", + "title": "Malicious file detection on upload", + "description": "", + "parent": "V12", "kind": "control" }, { - "control_id": "V9 Communication", - "title": "V9.1.1 — TLS for all connections", + "control_id": "V13", + "title": "API and Web Service", + "description": "Verify that API and web service requests are validated.", + "parent": null, + "function": "Verification", "kind": "control" }, { - "control_id": "V11 Business Logic", - "title": "V11.1.4 — Business logic limits on repeated actions", + "control_id": "V13.1", + "title": "Generic Web Service Security", + "description": "Verify that all API and web service interactions are authenticated and authorized.", + "parent": "V13", + "function": "Verification", "kind": "control" }, { - "control_id": "V3 Session Management", - "title": "V3.1.1 — Session tokens unique and random", + "control_id": "V13.1.1", + "title": "Verify API rate limiting", + "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", "kind": "control" }, { - "control_id": "V13 API", - "title": "V13.1.1 — API protection against enumeration", + "control_id": "V13.1.2", + "title": "API throttling", + "description": "", + "parent": "V13", "kind": "control" }, { - "control_id": "V5.1.2", - "title": "Verify that HTTP request parts are validated, sanitised, or rejected", - "description": "LLM API request validation — prompt structure, content type, and character set enforced", + "control_id": "V13.1.3", + "title": "Verify API rejects large unexpected payloads", + "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", "kind": "control" }, { - "control_id": "V8.1.1", - "title": "Verify sensitive data is not cached or exposed in logs", - "description": "LLM outputs containing sensitive data not logged in cleartext or cached without protection; System prompts not stored in cleartext application configuration or source code", + "control_id": "V14", + "title": "Configuration", + "description": "Verify that the application is securely configured.", + "parent": null, + "function": "Verification", "kind": "control" }, { - "control_id": "V8.3.4", - "title": "Verify PII is identified and protected", - "description": "PII in LLM training data, RAG sources, and outputs identified and handled per policy", - "kind": "control" + "control_id": "V14.1.4", + "title": "All components inventoried", + "kind": "control", + "parent": "V14" }, { - "control_id": "V4.2.2", - "title": "Verify anti-CSRF tokens in state-changing operations", - "description": "CSRF protection on endpoints where LLM output triggers state changes", + "control_id": "V14.2.2", + "title": "Verify build pipelines include security checks", + "description": "CI/CD pipeline for agent components includes integrity verification and CVE scanning; CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning", "kind": "control" }, { - "control_id": "V11.1.4", - "title": "Verify business logic rate limits", - "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", + "control_id": "V14.2.3", + "title": "Verify secrets not in source code", + "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system", "kind": "control" } ], @@ -8213,11 +8321,16 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-04-09", "change": "Initial seed — 32 ASVS verification requirements and sub-requirements", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 75 items -> 82, including 17 referenced by mappings but absent from the registry", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { "status": "unknown", - "included": 75, + "included": 82, "total": null, "note": "Authoritative control count not established. Needs a count from the published framework.", "source": "https://owasp.org/projects/asvs" @@ -8323,6 +8436,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 104 items -> 10", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 10 items -> 10", + "author": "OWASP GenAI Data Security Initiative" } ] }, @@ -8778,6 +8896,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Titled 17 entries that had carried only their identifier, from the published text: PCI DSS v4.0 requirement headings, transcribed from PCI SSC \"PCI DSS v4.0 SAQ D for Merchants\" — Req 1.3, Req 2.2, Req 3.4, Req 3.5, Req 4.2, Req 5.2, Req 6.3, Req 6.4, Req 7.2, Req 7.3, Req 8.2, Req 8.3, Req 10.2, Req 10.7, Req 11.3, Req 12.3, Req 12.6", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 49 items -> 49", + "author": "OWASP GenAI Data Security Initiative" } ] }, @@ -9169,6 +9292,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Titled 2 entries that had carried only their identifier, from the published text: TSP section 100, 2017 Trust Services Criteria (with Revised Points of Focus — 2022) — P7.1, PI1.3", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Migrated off the swapped-column ids of issue #35: 46 items -> 46", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { diff --git a/scripts/control-ids.js b/scripts/control-ids.js index d883973..b68b6ac 100644 --- a/scripts/control-ids.js +++ b/scripts/control-ids.js @@ -63,6 +63,13 @@ const GRAMMARS = { // the em dash should be. re: /\b([A-Z]{3})\b(?=\s*[^\sA-Za-z0-9])/, }, + 'OWASP ASVS 4.0.3': { + // Requirement ids are V.
.; the chapter alone + // (V8) is the parent, and some tables put the chapter in its own column. + re: /\b(V\d{1,2}\.\d{1,2}\.\d{1,2})\b/, + parentRe: /\b(V\d{1,2})\b(?!\.)/, + parent: (m) => m[1], + }, 'ISO/IEC 42001:2023': { // Annex A controls, Annex B guidance, and management-system clauses. re: /\b([AB]\.\d{1,2}(?:\.\d{1,2}){0,2})\b|\bCl(?:ause)?\.?\s*(\d{1,2}(?:\.\d{1,2}){0,2})\b/, @@ -157,6 +164,7 @@ const ID_SHAPES = { 'CWE/CVE': /^(?:CWE-\d{1,4}|CVE-\d{4}-\d{4,7})$/, 'OWASP AI Testing Guide': /^[A-Z]{3}$/, 'ISO/IEC 42001:2023': /^(?:[AB]\.\d{1,2}(?:\.\d{1,2}){0,2}|\d{1,2}(?:\.\d{1,2}){0,2})$/, + 'OWASP ASVS 4.0.3': /^V\d{1,2}\.\d{1,2}\.\d{1,2}$/, }; /** @@ -167,6 +175,9 @@ const ID_SHAPES = { */ const REGISTRY_EXTRA_SHAPES = { 'CIS Controls v8.1': /^CIS-\d{1,2}$/, + // ASVS registries carry the chapters (V8) beside the requirements (V8.1.1). + // chapters (V8) and sections (V8.1) sit in the registry beside requirements + 'OWASP ASVS 4.0.3': /^V\d{1,2}(\.\d{1,2})?$/, }; /** True when `id` is well-formed for `framework` in a registry file. */ From 2eb59c17734b799e287bdac57aedc83b8af8ba88 Mon Sep 17 00:00:00 2001 From: emmanuelgjr Date: Fri, 18 Sep 2026 16:12:39 -0400 Subject: [PATCH 2/5] ASVS 5.0: migrate LLM_ASVS.md (36 rows translated, 4 retained) Identifiers translated with the ASVS project own mapping file; requirement text replaced with 5.0.0 own wording; schema v2 columns added to every mapping table with relationship, rationale type and confidence reading DRAFT, because whether a 5.0.0 requirement still addresses the GenAI risk the row claims is expert judgment (C4), not a translation. Rows citing requirements 5.0.0 deleted keep their 4.0.3 identifier, carry a DRAFT marker naming the official disposition, and their Framework ver. column reads ASVS 4.0.3. The maturity-roadmap table is not a mapping table and gets no v2 columns, but its identifiers are translated too, so the file does not cite 4.0.3 numbers beside 5.0.0 ones. Co-Authored-By: Claude Opus 5 (1M context) --- llm-top10/LLM_ASVS.md | 146 ++++++++++++++++++++++-------------------- 1 file changed, 75 insertions(+), 71 deletions(-) diff --git a/llm-top10/LLM_ASVS.md b/llm-top10/LLM_ASVS.md index 5792519..4cbfb66 100644 --- a/llm-top10/LLM_ASVS.md +++ b/llm-top10/LLM_ASVS.md @@ -1,7 +1,7 @@ 26** frameworks | Compliance · Governance · Threat modeling · Testing · OT/ICS · Identity · Secure SDLC · Financial | | **77** mapping files | Every source list entry × every applicable framework | | **Mapping review state** | 2 of 26 carry candidate DRAFT rows only — CoSAI · EU AI Act Code of Practice — see [docs/SCHEMA_V2_MIGRATION.md](docs/SCHEMA_V2_MIGRATION.md) | -| **Framework freshness** | 3 current · 2 behind upstream · 21 unchecked — see [docs/FRESHNESS_SLA.md](docs/FRESHNESS_SLA.md) | +| **Framework freshness** | 4 current · 1 behind upstream · 21 unchecked — see [docs/FRESHNESS_SLA.md](docs/FRESHNESS_SLA.md) | | **21** implementation recipes | Production-ready Python patterns | | **70+** open-source tools | Catalogued and organised by function | | **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries | diff --git a/data/backlinks.json b/data/backlinks.json index dc996c7..e5f09bb 100644 --- a/data/backlinks.json +++ b/data/backlinks.json @@ -30538,7 +30538,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM data flows threat-modelled — all injection paths identified and documented" + "notes": "LLM data flows threat-modelled — all injection paths identified and documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "ASI01", @@ -30547,7 +30547,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All agent input sources threat-modelled — every indirect injection path documented" + "notes": "All agent input sources threat-modelled — every indirect injection path documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "ASI04", @@ -30556,7 +30556,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Supply chain threat model documents all agent component sources and trust levels" + "notes": "Supply chain threat model documents all agent component sources and trust levels — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "DSGAI16", @@ -30565,7 +30565,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, @@ -30581,101 +30581,58 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10.2.1", - "control_name": "Verify third-party components are current and free from vulnerabilities", + "control_id": "V1.2.4", + "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained" + "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Training pipeline components scanned — compromised dependencies rejected" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored" + "notes": "No raw agent output in SQL context — parameterised execution only" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", - "scope": "Both", + "tier": "Foundational", + "scope": "Build", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10.2.2", - "control_name": "Verify only minimal approved external libraries are used", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Approved component list — unsigned or unverified agent components rejected" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "LLM output encoding before passing to downstream renderers or interpreters" }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.1", - "control_name": "Verify business logic assumptions documented", - "entries": [ { "id": "LLM07", "name": "Misinformation", @@ -30683,50 +30640,16 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted" - }, - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent abuse of LLM functions", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions" + "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Business logic controls preventing tool misuse through prompt manipulation" + "notes": "LLM responses rendered in browser contexts encoded against XSS" }, { "id": "ASI01", @@ -30735,16 +30658,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Business logic controls prevent injection from redirecting agent goal" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified" + "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted" }, { "id": "ASI05", @@ -30753,72 +30667,63 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis" + "notes": "Agent code output encoded before rendering in any context" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Circuit breakers as business logic controls — cascade propagation limited by design" + "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope" + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.4", - "control_name": "Verify business logic rate limits", + "control_id": "V1.3.2", + "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null + "notes": "No eval or dynamic code execution of LLM-generated content" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.5", - "control_name": "Business logic prevents excess data access", + "control_id": "V1.3.5", + "control_name": "Output encoding for context", "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null @@ -30827,77 +30732,61 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.7", - "control_name": "Anti-automation controls", + "control_id": "V1.3.6", + "control_name": "Defined output structure", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", - "control_name": "Verify file uploads scanned for malware", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Training data uploads scanned before ingestion — adversarial content detected" + "notes": "LLM-generated content validated before execution in any shell or interpreter context" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Content validation on all vector store ingestion — adversarial content detected" + "notes": "LLM-generated commands validated — never raw output in shell context" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write" + "notes": "Agent-generated instructions not executed in system context without validation" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Agent-generated commands validated before any shell execution" }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.3", - "control_name": "Malicious file detection on upload", - "entries": [ { "id": "DSGAI09", "name": "Multimodal Cross-Channel Leakage", @@ -30911,7 +30800,7 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "entries": [ { @@ -30921,7 +30810,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting on all LLM API endpoints — per user, per session, per API key" + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio" }, { "id": "ASI02", @@ -30930,7 +30819,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool API endpoints rate-limited — anomalous invocation frequency detected" + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio" }, { "id": "ASI08", @@ -30939,7 +30828,7 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited" + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio" }, { "id": "ASI10", @@ -30948,7 +30837,7 @@ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion" + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio" }, { "id": "DSGAI12", @@ -30963,65 +30852,51 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.2", - "control_name": "API throttling", + "control_id": "V10.2.1", + "control_name": "Verify third-party components are current and free from vulnerabilities", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.3", - "control_name": "Verify API rejects large unexpected payloads", - "entries": [ + "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway" + "notes": "Training pipeline components scanned — compromised dependencies rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.1.4", - "control_name": "All components inventoried", - "entries": [ + "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.2", - "control_name": "Verify build pipelines include security checks", + "control_id": "V10.2.2", + "control_name": "Verify only minimal approved external libraries are used", "entries": [ { "id": "LLM04", @@ -31030,7 +30905,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning" + "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" }, { "id": "ASI04", @@ -31039,63 +30914,72 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "CI/CD pipeline for agent components includes integrity verification and CVE scanning" + "notes": "Approved component list — unsigned or unverified agent components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.3", - "control_name": "Verify secrets not in source code", + "control_id": "V11.1.7", + "control_name": "Anti-automation controls", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompts not hardcoded in source code — stored in secret management system" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credentials not committed to source control" + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", - "control_name": "Verify credentials not in source code", + "control_id": "V12.2.1", + "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials not hardcoded — secret manager required" + "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": null @@ -31104,132 +30988,141 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.10.1", - "control_name": "Integration secrets not hardcoded", + "control_id": "V13.1.2", + "control_name": "API throttling", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.1.1", - "control_name": "Session tokens unique and random", + "control_id": "V13.2.1", + "control_name": "Integration secrets not hardcoded", "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.3.1", - "control_name": "Verify anti-replay tokens in state-changing operations", + "control_id": "V13.4.5", + "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers" + "notes": "CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "CI/CD pipeline for agent components includes integrity verification and CVE scanning" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", - "control_name": "Verify all sensitive functions have access control", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation" + "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "All vector store content encrypted at rest" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session" + "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "severity": "Medium", + "tier": "Hardening", "scope": "Build", "notes": null }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", @@ -31240,8 +31133,8 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.2", - "control_name": "Least privilege for service accounts", + "control_id": "V14.1.2", + "control_name": "Data transferred using current TLS", "entries": [ { "id": "DSGAI02", @@ -31251,120 +31144,55 @@ "tier": "Foundational", "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V14.1.4", + "control_name": "All components inventoried", + "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control decisions enforce least privilege", + "control_id": "V14.2.1", + "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access" + "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway" }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM tool access enforced at minimum required scope — read-only by default" + "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System prompt access restricted to authorised personnel — read access logged" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "RBAC on all vector store collections — no unauthenticated access" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential scope minimum required — no over-privileged NHIs" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "A2A channels enforce sender identity — unauthenticated messages rejected" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null }, { @@ -31380,49 +31208,67 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.5", - "control_name": "Access control failures logged", + "control_id": "V14.2.2", + "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", + "notes": "System prompts not stored in cleartext application configuration or source code" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", "notes": null }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.2.2", - "control_name": "Verify anti-CSRF tokens in state-changing operations", + "control_id": "V15.3.3", + "control_name": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "CSRF protection on endpoints where LLM output triggers state changes" + "notes": "LLM API request validation — prompt structure, content type, and character set enforced" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all user input validated against an allowlist or rejected", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "entries": [ { "id": "LLM01", @@ -31482,94 +31328,146 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.2", - "control_name": "Verify that HTTP request parts are validated, sanitised, or rejected", + "control_id": "V16.2.5", + "control_name": "No credential logging", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "LLM API request validation — prompt structure, content type, and character set enforced" + "scope": "Build", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.3", - "control_name": "Input validation server-side", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All access to system prompts logged — unauthorised access attempts detectable" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "All credential usage logged — issuance, access, expiry detectable" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "All A2A messages logged — sender identity, content hash, schema validation results" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "All agent actions logged — no production deployment without complete observability" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding prevents injection attacks", + "control_id": "V16.3.2", + "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM output encoding before passing to downstream renderers or interpreters" + "notes": "All LLM tool invocations logged with full context — every tool call auditable" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source" + "notes": null }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", + "entries": [ + { + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM responses rendered in browser contexts encoded against XSS" + "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted" + "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent code output encoded before rendering in any context" + "notes": "Cascade errors handled gracefully — no sensitive system information in error responses" }, { "id": "ASI09", @@ -31578,7 +31476,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content" + "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable" }, { "id": "DSGAI05", @@ -31593,73 +31491,55 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.4", - "control_name": "Verify application does not use eval or dynamic code", + "control_id": "V16.5.3", + "control_name": "Access control failures logged", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "No eval or dynamic code execution of LLM-generated content" + "notes": null }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review" + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify application protects against OS command injection", + "control_id": "V2.2.1", + "control_name": "Input validation server-side", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "LLM-generated content validated before execution in any shell or interpreter context" + "notes": null }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM-generated commands validated — never raw output in shell context" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent-generated instructions not executed in system context without validation" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Agent-generated commands validated before any shell execution" + "notes": null }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", @@ -31670,183 +31550,162 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.6", - "control_name": "Defined output structure", + "control_id": "V2.3.1", + "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "entries": [ { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.8", - "control_name": "Output encoding for context", - "entries": [ + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.4", - "control_name": "SQL injection prevention", - "entries": [ + "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.5", - "control_name": "Verify output encoding in SQL query context", + "control_id": "V2.4.1", + "control_name": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context" + "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "No raw agent output in SQL context — parameterised execution only" + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify all sensitive data encrypted at rest", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Training data, embeddings, RAG document stores, and prompt caches encrypted at rest" + "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "All vector store content encrypted at rest" + "notes": "Business logic controls preventing tool misuse through prompt manipulation" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory" + "notes": "Business logic controls prevent injection from redirecting agent goal" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory" + "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Circuit breakers as business logic controls — cascade propagation limited by design" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.1.1", - "control_name": "No credential logging", - "entries": [ - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null + "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.1.2", - "control_name": "No sensitive data in logs", + "control_id": "V3.5.1", + "control_name": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).", "entries": [ { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "CSRF protection on endpoints where LLM output triggers state changes" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify access control decisions logged", + "control_id": "V3.6.1", + "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.", "entries": [ { "id": "LLM08", @@ -31855,7 +31714,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All access to system prompts logged — unauthorised access attempts detectable" + "notes": "System prompts not hardcoded in source code — stored in secret management system" }, { "id": "ASI03", @@ -31864,72 +31723,54 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All credential usage logged — issuance, access, expiry detectable" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A messages logged — sender identity, content hash, schema validation results" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "All agent actions logged — no production deployment without complete observability" + "notes": "Agent credentials not committed to source control" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", - "control_name": "Verify all business logic decisions logged", + "control_id": "V5.2.1", + "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "All LLM tool invocations logged with full context — every tool call auditable" + "notes": "Training data uploads scanned before ingestion — adversarial content detected" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp" + "notes": "Content validation on all vector store ingestion — adversarial content detected" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis" + "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", "notes": null }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -31940,91 +31781,71 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify error handling does not expose sensitive data", + "control_id": "V5.2.4", + "control_name": "Malicious file detection on upload", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses" - }, - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Cascade errors handled gracefully — no sensitive system information in error responses" - }, - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", + "severity": "High", + "tier": "Hardening", + "scope": "Both", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data is not cached or exposed in logs", + "control_id": "V6.2.1", + "control_name": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" + "notes": "Agent credentials not hardcoded — secret manager required" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompts not stored in cleartext application configuration or source code" + "notes": null }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", "scope": "Both", "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V7.4.1", + "control_name": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -32045,7 +31866,7 @@ "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": null + "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, INSUFFICIENT IMPACT; retarget or drop pending SME review (#22)**" } ] }, @@ -32061,7 +31882,7 @@ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "DSGAI09", @@ -32070,7 +31891,7 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "DSGAI15", @@ -32079,7 +31900,7 @@ "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": null + "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "DSGAI20", @@ -32088,34 +31909,126 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.10", - "control_name": "Personal data not kept longer than needed", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access" + }, + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM tool access enforced at minimum required scope — read-only by default" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt access restricted to authorised personnel — read access logged" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "RBAC on all vector store collections — no unauthenticated access" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credential scope minimum required — no over-privileged NHIs" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A channels enforce sender identity — unauthenticated messages rejected" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.3", - "control_name": "Consent obtained before PI processing", - "entries": [ + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -32135,30 +32048,30 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", - "control_name": "Verify PII is identified and protected", + "control_id": "V8.3.1", + "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" + "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -32166,17 +32079,35 @@ "notes": null }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Build", "notes": null }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", @@ -32187,51 +32118,42 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.7", - "control_name": "Data transferred using current TLS", + "control_id": "V8.3.10", + "control_name": "Personal data not kept longer than needed", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", - "control_name": "Verify all sensitive data encrypted in transit", + "control_id": "V8.3.3", + "control_name": "Consent obtained before PI processing", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, diff --git a/data/entries/ASI01.json b/data/entries/ASI01.json index 2028810..c911084 100644 --- a/data/entries/ASI01.json +++ b/data/entries/ASI01.json @@ -311,31 +311,34 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all user input validated against allowlist", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "tier": "Foundational", "scope": "Both", "notes": "All inputs to agents validated — indirect injection through processed content equally in scope", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding prevents injection", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify application protects against OS command injection", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "tier": "Foundational", "scope": "Both", "notes": "Agent-generated instructions not executed in system context without validation", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -345,17 +348,19 @@ "control_name": "Threat modelling of all data flows", "tier": "Foundational", "scope": "Both", - "notes": "All agent input sources threat-modelled — every indirect injection path documented", + "notes": "All agent input sources threat-modelled — every indirect injection path documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent function abuse", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Business logic controls prevent injection from redirecting agent goal", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI02.json b/data/entries/ASI02.json index 2e057db..e7c4a68 100644 --- a/data/entries/ASI02.json +++ b/data/entries/ASI02.json @@ -318,51 +318,56 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", - "control_name": "Verify all sensitive functions have access control", + "control_id": "V8.3.1", + "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.", "tier": "Foundational", "scope": "Both", "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", - "control_name": "Verify all business logic decisions logged", + "control_id": "V16.3.2", + "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", "tier": "Foundational", "scope": "Both", "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic abuse scenarios identified", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "tier": "Foundational", "scope": "Both", - "notes": "Tool API endpoints rate-limited — anomalous invocation frequency detected", + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI03.json b/data/entries/ASI03.json index aca26b3..ece2f67 100644 --- a/data/entries/ASI03.json +++ b/data/entries/ASI03.json @@ -311,51 +311,56 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", - "control_name": "Verify credentials not in source code", + "control_id": "V6.2.1", + "control_name": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials not hardcoded — secret manager required", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "Agent credential scope minimum required — no over-privileged NHIs", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify sensitive data encrypted at rest", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify access control decisions logged", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "tier": "Foundational", "scope": "Both", "notes": "All credential usage logged — issuance, access, expiry detectable", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.3", - "control_name": "Verify secrets not in source code", + "control_id": "V3.6.1", + "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials not committed to source control", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI04.json b/data/entries/ASI04.json index 97e4c7a..5782a99 100644 --- a/data/entries/ASI04.json +++ b/data/entries/ASI04.json @@ -326,7 +326,8 @@ "control_name": "Verify third-party components current and free of vulnerabilities", "tier": "Foundational", "scope": "Both", - "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored", + "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -336,17 +337,19 @@ "control_name": "Verify only minimal approved external libraries", "tier": "Foundational", "scope": "Both", - "notes": "Approved component list — unsigned or unverified agent components rejected", + "notes": "Approved component list — unsigned or unverified agent components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.2", - "control_name": "Verify build pipelines include security checks", + "control_id": "V13.4.5", + "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.", "tier": "Foundational", "scope": "Both", "notes": "CI/CD pipeline for agent components includes integrity verification and CVE scanning", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -356,7 +359,8 @@ "control_name": "Verify threat model covers all data flows", "tier": "Foundational", "scope": "Both", - "notes": "Supply chain threat model documents all agent component sources and trust levels", + "notes": "Supply chain threat model documents all agent component sources and trust levels — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI05.json b/data/entries/ASI05.json index 899faa9..03f548d 100644 --- a/data/entries/ASI05.json +++ b/data/entries/ASI05.json @@ -311,51 +311,56 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding of untrusted data in HTML context", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Hardening", "scope": "Both", "notes": "Agent code output encoded before rendering in any context", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.4", - "control_name": "Verify application does not use eval or dynamic code", + "control_id": "V1.3.2", + "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.", "tier": "Hardening", "scope": "Both", "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify output encoding in OS command context", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "tier": "Hardening", "scope": "Both", "notes": "Agent-generated commands validated before any shell execution", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.5", - "control_name": "Verify output encoding in SQL context", + "control_id": "V1.2.4", + "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.", "tier": "Hardening", "scope": "Both", "notes": "No raw agent output in SQL context — parameterised execution only", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Hardening", "scope": "Both", "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI06.json b/data/entries/ASI06.json index 9f531ce..f0265d8 100644 --- a/data/entries/ASI06.json +++ b/data/entries/ASI06.json @@ -311,41 +311,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all user input validated against allowlist", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "tier": "Hardening", "scope": "Both", "notes": "All content entering agent memory validated — injection patterns rejected at write boundary", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Hardening", "scope": "Both", "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify sensitive data encrypted at rest", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Hardening", "scope": "Both", "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", - "control_name": "Verify file upload malware scanning", + "control_id": "V5.2.1", + "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", "tier": "Hardening", "scope": "Both", "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI07.json b/data/entries/ASI07.json index 0b7ba37..61c19bd 100644 --- a/data/entries/ASI07.json +++ b/data/entries/ASI07.json @@ -311,41 +311,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", - "control_name": "Verify TLS used for all client connectivity", + "control_id": "V12.2.1", + "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.", "tier": "Hardening", "scope": "Both", "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.3.1", - "control_name": "Verify anti-replay tokens in state-changing operations", + "control_id": "V7.4.1", + "control_name": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.", "tier": "Hardening", "scope": "Both", "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces identity", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Hardening", "scope": "Both", "notes": "A2A channels enforce sender identity — unauthenticated messages rejected", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify all security controls logged", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "tier": "Hardening", "scope": "Both", "notes": "All A2A messages logged — sender identity, content hash, schema validation results", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI08.json b/data/entries/ASI08.json index 9f11c5e..79d2ed8 100644 --- a/data/entries/ASI08.json +++ b/data/entries/ASI08.json @@ -311,41 +311,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.1", - "control_name": "Verify business logic assumptions documented", + "control_id": "V2.3.1", + "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "tier": "Foundational", "scope": "Both", "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent abuse", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Circuit breakers as business logic controls — cascade propagation limited by design", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited", + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify error handling does not expose sensitive data", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", "tier": "Foundational", "scope": "Both", "notes": "Cascade errors handled gracefully — no sensitive system information in error responses", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI09.json b/data/entries/ASI09.json index 62f51af..e94d7e1 100644 --- a/data/entries/ASI09.json +++ b/data/entries/ASI09.json @@ -311,41 +311,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.1", - "control_name": "Verify business logic assumptions documented", + "control_id": "V2.3.1", + "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "tier": "Foundational", "scope": "Both", "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify outputs encoded before rendering", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify all security controls logged", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", "tier": "Foundational", "scope": "Both", "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.3", - "control_name": "Verify API rejects large unexpected payloads", + "control_id": "V14.2.1", + "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.", "tier": "Foundational", "scope": "Both", "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI10.json b/data/entries/ASI10.json index 9d08e24..5c94f89 100644 --- a/data/entries/ASI10.json +++ b/data/entries/ASI10.json @@ -321,41 +321,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify access control decisions logged", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "tier": "Hardening", "scope": "Both", "notes": "All agent actions logged — no production deployment without complete observability", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", - "control_name": "Verify all business logic decisions logged", + "control_id": "V16.3.2", + "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", "tier": "Hardening", "scope": "Both", "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent abuse", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Hardening", "scope": "Both", "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "tier": "Hardening", "scope": "Both", - "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion", + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI01.json b/data/entries/DSGAI01.json index d6b8b5a..6765b51 100644 --- a/data/entries/DSGAI01.json +++ b/data/entries/DSGAI01.json @@ -315,51 +315,56 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", + "control_id": "V14.2.2", "control_name": "Sensitive data not transmitted in URL parameters", "tier": "Foundational", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", + "control_id": "V14.1.1", "control_name": "Sensitive data identified and classified", "tier": "Foundational", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", + "control_id": "V8.2.1", "control_name": "Deny by default access control", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.8", + "control_id": "V1.3.5", "control_name": "Output encoding for context", "tier": "Foundational", "scope": "Both", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", + "control_id": "V14.1.1", "control_name": "Sensitive data not stored in cleartext", "tier": "Foundational", "scope": "Both", "parent": "V6", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI02.json b/data/entries/DSGAI02.json index 0a541f8..48646a9 100644 --- a/data/entries/DSGAI02.json +++ b/data/entries/DSGAI02.json @@ -315,41 +315,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", + "control_id": "V6.2.1", "control_name": "Passwords minimum 12 characters", "tier": "Foundational", "scope": "Both", "parent": "V2", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.10.1", + "control_id": "V13.2.1", "control_name": "Integration secrets not hardcoded", "tier": "Foundational", "scope": "Both", "parent": "V2", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.2", + "control_id": "V8.2.1", "control_name": "Least privilege for service accounts", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.7", + "control_id": "V14.1.2", "control_name": "Data transferred using current TLS", "tier": "Foundational", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI03.json b/data/entries/DSGAI03.json index 085c174..f005dae 100644 --- a/data/entries/DSGAI03.json +++ b/data/entries/DSGAI03.json @@ -310,26 +310,30 @@ "tier": "Foundational", "scope": "Both", "parent": "V1", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.5", + "control_id": "V16.5.3", "control_name": "Access control failures logged", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", + "control_id": "V16.3.2", "control_name": "Log entries contain required information", "tier": "Foundational", "scope": "Both", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -340,6 +344,8 @@ "tier": "Foundational", "scope": "Both", "parent": "V14", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI04.json b/data/entries/DSGAI04.json index 3e2d74a..f6fdc8d 100644 --- a/data/entries/DSGAI04.json +++ b/data/entries/DSGAI04.json @@ -305,11 +305,12 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.3", + "control_id": "V2.2.1", "control_name": "Input validation server-side", "tier": "Hardening", "scope": "Both", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -320,6 +321,8 @@ "tier": "Hardening", "scope": "Both", "parent": "V10", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -330,16 +333,19 @@ "tier": "Hardening", "scope": "Both", "parent": "V10", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", + "control_id": "V5.2.1", "control_name": "File upload size limits", "tier": "Hardening", "scope": "Both", "parent": "V12", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI05.json b/data/entries/DSGAI05.json index 5f845df..07810d0 100644 --- a/data/entries/DSGAI05.json +++ b/data/entries/DSGAI05.json @@ -285,31 +285,34 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", + "control_id": "V15.3.7", "control_name": "Input validation using allowlists", "tier": "Foundational", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", + "control_id": "V1.3.1", "control_name": "HTML/JS output sanitised", "tier": "Foundational", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", + "control_id": "V16.5.1", "control_name": "Generic error messages", "tier": "Foundational", "scope": "Build", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI06.json b/data/entries/DSGAI06.json index 41e38dc..8412182 100644 --- a/data/entries/DSGAI06.json +++ b/data/entries/DSGAI06.json @@ -295,31 +295,34 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control on every request", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", + "control_id": "V12.2.1", "control_name": "TLS for all connections", "tier": "Foundational", "scope": "Both", "parent": "V9", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.4", + "control_id": "V2.4.1", "control_name": "Business logic limits on repeated actions", "tier": "Foundational", "scope": "Both", "parent": "V11", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI07.json b/data/entries/DSGAI07.json index 9ef4ac2..03a4e83 100644 --- a/data/entries/DSGAI07.json +++ b/data/entries/DSGAI07.json @@ -310,26 +310,30 @@ "tier": "Foundational", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", + "control_id": "V14.1.1", "control_name": "Sensitive data identified and classified", "tier": "Foundational", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.5", + "control_id": "V16.5.3", "control_name": "Attribute-based access control", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI08.json b/data/entries/DSGAI08.json index 9e14652..66f4ae0 100644 --- a/data/entries/DSGAI08.json +++ b/data/entries/DSGAI08.json @@ -300,6 +300,8 @@ "tier": "Foundational", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -310,16 +312,19 @@ "tier": "Foundational", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", + "control_id": "V16.3.2", "control_name": "Audit trail sufficient for compliance", "tier": "Foundational", "scope": "Both", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI09.json b/data/entries/DSGAI09.json index 278f624..ec0c751 100644 --- a/data/entries/DSGAI09.json +++ b/data/entries/DSGAI09.json @@ -295,11 +295,12 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", + "control_id": "V1.3.7", "control_name": "Unstructured data sanitised", "tier": "Hardening", "scope": "Both", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -310,16 +311,19 @@ "tier": "Hardening", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.3", + "control_id": "V5.2.4", "control_name": "Malicious file detection on upload", "tier": "Hardening", "scope": "Both", "parent": "V12", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI10.json b/data/entries/DSGAI10.json index 7ffa9ad..45929d4 100644 --- a/data/entries/DSGAI10.json +++ b/data/entries/DSGAI10.json @@ -275,21 +275,23 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", + "control_id": "V14.1.1", "control_name": "Sensitive data classified", "tier": "Hardening", "scope": "Build", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.6", + "control_id": "V1.3.6", "control_name": "Defined output structure", "tier": "Hardening", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI11.json b/data/entries/DSGAI11.json index 062e1b9..fc9f2f3 100644 --- a/data/entries/DSGAI11.json +++ b/data/entries/DSGAI11.json @@ -295,31 +295,34 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.1.1", + "control_id": "V14.2.1", "control_name": "Session tokens unique and random", "tier": "Foundational", "scope": "Build", "parent": "V3", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.3.1", + "control_id": "V7.4.1", "control_name": "Sessions invalidated after logout", "tier": "Foundational", "scope": "Build", "parent": "V3", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control enforced on every request", "tier": "Foundational", "scope": "Build", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -330,6 +333,8 @@ "tier": "Foundational", "scope": "Build", "parent": "V8", + "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, INSUFFICIENT IMPACT; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI12.json b/data/entries/DSGAI12.json index 2eb09ec..1c69ac2 100644 --- a/data/entries/DSGAI12.json +++ b/data/entries/DSGAI12.json @@ -305,41 +305,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", + "control_id": "V15.3.7", "control_name": "Allowlist input validation", "tier": "Foundational", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.4", + "control_id": "V1.2.4", "control_name": "SQL injection prevention", "tier": "Foundational", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control on every request", "tier": "Foundational", "scope": "Build", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "API protection against enumeration", "tier": "Foundational", "scope": "Build", "parent": "V13", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI13.json b/data/entries/DSGAI13.json index 466f0b6..d1a3ef6 100644 --- a/data/entries/DSGAI13.json +++ b/data/entries/DSGAI13.json @@ -295,31 +295,34 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", + "control_id": "V8.2.1", "control_name": "Deny by default", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", + "control_id": "V14.1.1", "control_name": "Sensitive data not stored in cleartext", "tier": "Foundational", "scope": "Both", "parent": "V6", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", + "control_id": "V5.2.1", "control_name": "File upload validation", "tier": "Foundational", "scope": "Both", "parent": "V12", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI14.json b/data/entries/DSGAI14.json index 37f29c3..2c74821 100644 --- a/data/entries/DSGAI14.json +++ b/data/entries/DSGAI14.json @@ -295,41 +295,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.1.1", + "control_id": "V16.2.5", "control_name": "No credential logging", "tier": "Foundational", "scope": "Build", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.1.2", + "control_id": "V16.2.5", "control_name": "No sensitive data in logs", "tier": "Foundational", "scope": "Build", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", + "control_id": "V14.2.2", "control_name": "Sensitive data not in URLs", "tier": "Foundational", "scope": "Build", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control on log stores", "tier": "Foundational", "scope": "Build", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI15.json b/data/entries/DSGAI15.json index 600468e..84a7a7e 100644 --- a/data/entries/DSGAI15.json +++ b/data/entries/DSGAI15.json @@ -295,11 +295,12 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", + "control_id": "V8.2.1", "control_name": "Deny by default access control", "tier": "Foundational", "scope": "Build", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -310,16 +311,19 @@ "tier": "Foundational", "scope": "Build", "parent": "V8", + "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.1.1", + "control_id": "V14.2.1", "control_name": "Session isolation", "tier": "Foundational", "scope": "Build", "parent": "V3", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI16.json b/data/entries/DSGAI16.json index a6337d8..2abed25 100644 --- a/data/entries/DSGAI16.json +++ b/data/entries/DSGAI16.json @@ -295,21 +295,23 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.2", + "control_id": "V8.2.1", "control_name": "Least privilege", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.5", + "control_id": "V2.2.1", "control_name": "Business logic prevents excess data access", "tier": "Foundational", "scope": "Both", "parent": "V11", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -320,6 +322,8 @@ "tier": "Foundational", "scope": "Both", "parent": "V1", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI17.json b/data/entries/DSGAI17.json index d84e91e..367f943 100644 --- a/data/entries/DSGAI17.json +++ b/data/entries/DSGAI17.json @@ -290,6 +290,8 @@ "tier": "Foundational", "scope": "Both", "parent": "V11", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -300,6 +302,8 @@ "tier": "Foundational", "scope": "Both", "parent": "V13", + "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI18.json b/data/entries/DSGAI18.json index e2f7fca..3eea231 100644 --- a/data/entries/DSGAI18.json +++ b/data/entries/DSGAI18.json @@ -275,21 +275,23 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", + "control_id": "V14.1.1", "control_name": "Sensitive data identified", "tier": "Hardening", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", + "control_id": "V14.1.1", "control_name": "Sensitive data not stored in cleartext", "tier": "Hardening", "scope": "Both", "parent": "V6", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI19.json b/data/entries/DSGAI19.json index 2199731..891f050 100644 --- a/data/entries/DSGAI19.json +++ b/data/entries/DSGAI19.json @@ -285,11 +285,12 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.2", + "control_id": "V8.2.1", "control_name": "Least privilege", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -300,16 +301,19 @@ "tier": "Foundational", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", + "control_id": "V6.2.1", "control_name": "Strong authentication", "tier": "Foundational", "scope": "Both", "parent": "V2", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI20.json b/data/entries/DSGAI20.json index 207b529..7174f86 100644 --- a/data/entries/DSGAI20.json +++ b/data/entries/DSGAI20.json @@ -295,11 +295,12 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control per request", "tier": "Hardening", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -310,6 +311,8 @@ "tier": "Hardening", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -320,6 +323,8 @@ "tier": "Hardening", "scope": "Both", "parent": "V10", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI21.json b/data/entries/DSGAI21.json index 00ea27e..8822935 100644 --- a/data/entries/DSGAI21.json +++ b/data/entries/DSGAI21.json @@ -305,21 +305,23 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.3", + "control_id": "V2.2.1", "control_name": "Server-side input validation", "tier": "Hardening", "scope": "Both", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.4", + "control_id": "V2.4.1", "control_name": "Enforce business logic limits", "tier": "Hardening", "scope": "Both", "parent": "V11", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM01.json b/data/entries/LLM01.json index 1dfc4bb..a4822f7 100644 --- a/data/entries/LLM01.json +++ b/data/entries/LLM01.json @@ -249,41 +249,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all user input validated against an allowlist or rejected", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "tier": "Foundational", "scope": "Both", "notes": "All inputs to LLMs validated — indirect injection through processed content equally in scope", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.2", - "control_name": "Verify that HTTP request parts are validated, sanitised, or rejected", + "control_id": "V15.3.3", + "control_name": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.", "tier": "Foundational", "scope": "Both", "notes": "LLM API request validation — prompt structure, content type, and character set enforced", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding prevents injection attacks", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "LLM output encoding before passing to downstream renderers or interpreters", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify application protects against OS command injection", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated content validated before execution in any shell or interpreter context", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -293,17 +297,19 @@ "control_name": "Threat modelling of all data flows", "tier": "Foundational", "scope": "Both", - "notes": "LLM data flows threat-modelled — all injection paths identified and documented", + "notes": "LLM data flows threat-modelled — all injection paths identified and documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent abuse of LLM functions", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM02.json b/data/entries/LLM02.json index 889a5fb..80618de 100644 --- a/data/entries/LLM02.json +++ b/data/entries/LLM02.json @@ -259,51 +259,56 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data is not cached or exposed in logs", + "control_id": "V14.2.2", + "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.", "tier": "Foundational", "scope": "Both", "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", - "control_name": "Verify PII is identified and protected", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Foundational", "scope": "Both", "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control decisions enforce least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify all sensitive data encrypted at rest", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Foundational", "scope": "Both", "notes": "Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", - "control_name": "Verify all sensitive data encrypted in transit", + "control_id": "V12.2.1", + "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.", "tier": "Foundational", "scope": "Both", "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM03.json b/data/entries/LLM03.json index 45b2016..289a7a1 100644 --- a/data/entries/LLM03.json +++ b/data/entries/LLM03.json @@ -227,41 +227,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "LLM tool access enforced at minimum required scope — read-only by default", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", - "control_name": "Verify all sensitive functions have access control", + "control_id": "V8.3.1", + "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.", "tier": "Foundational", "scope": "Both", "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", - "control_name": "Verify all business logic decisions logged", + "control_id": "V16.3.2", + "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", "tier": "Foundational", "scope": "Both", "notes": "All LLM tool invocations logged with full context — every tool call auditable", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic abuse scenarios identified", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Business logic controls preventing tool misuse through prompt manipulation", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM04.json b/data/entries/LLM04.json index 0aef8e7..3508219 100644 --- a/data/entries/LLM04.json +++ b/data/entries/LLM04.json @@ -252,7 +252,8 @@ "control_name": "Verify third-party components are current and free from vulnerabilities", "tier": "Foundational", "scope": "Both", - "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained", + "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -262,17 +263,19 @@ "control_name": "Verify only minimal approved external libraries are used", "tier": "Foundational", "scope": "Both", - "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected", + "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.2", - "control_name": "Verify build pipelines include security checks", + "control_id": "V13.4.5", + "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.", "tier": "Foundational", "scope": "Both", "notes": "CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM05.json b/data/entries/LLM05.json index b964730..f3e6993 100644 --- a/data/entries/LLM05.json +++ b/data/entries/LLM05.json @@ -259,11 +259,12 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all inputs validated against allowlist", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "tier": "Hardening", "scope": "Both", "notes": "Training data pipeline input validation — anomalous data rejected before training", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -273,17 +274,19 @@ "control_name": "Verify third-party components free of vulnerabilities", "tier": "Hardening", "scope": "Both", - "notes": "Training pipeline components scanned — compromised dependencies rejected", + "notes": "Training pipeline components scanned — compromised dependencies rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", - "control_name": "Verify file uploads scanned for malware", + "control_id": "V5.2.1", + "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", "tier": "Hardening", "scope": "Both", "notes": "Training data uploads scanned before ingestion — adversarial content detected", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM06.json b/data/entries/LLM06.json index 782cb50..e46d797 100644 --- a/data/entries/LLM06.json +++ b/data/entries/LLM06.json @@ -227,41 +227,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting on all LLM API endpoints — per user, per session, per API key", + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.3", - "control_name": "Verify API rejects large unexpected payloads", + "control_id": "V14.2.1", + "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.", "tier": "Foundational", "scope": "Both", "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.4", - "control_name": "Verify business logic rate limits", + "control_id": "V2.4.1", + "control_name": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.", "tier": "Foundational", "scope": "Both", "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify error handling does not expose sensitive data", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", "tier": "Foundational", "scope": "Both", "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM07.json b/data/entries/LLM07.json index d5f5ef7..570bbe7 100644 --- a/data/entries/LLM07.json +++ b/data/entries/LLM07.json @@ -227,31 +227,34 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.1", - "control_name": "Verify business logic assumptions documented", + "control_id": "V2.3.1", + "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "tier": "Foundational", "scope": "Both", "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify all security controls logged", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", "tier": "Foundational", "scope": "Both", "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify outputs encoded before rendering", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM08.json b/data/entries/LLM08.json index a1674fb..ac1e34c 100644 --- a/data/entries/LLM08.json +++ b/data/entries/LLM08.json @@ -227,41 +227,45 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data not cached in cleartext", + "control_id": "V14.2.2", + "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.", "tier": "Foundational", "scope": "Both", "notes": "System prompts not stored in cleartext application configuration or source code", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "System prompt access restricted to authorised personnel — read access logged", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify access control decisions logged", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "tier": "Foundational", "scope": "Both", "notes": "All access to system prompts logged — unauthorised access attempts detectable", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.3", - "control_name": "Verify secrets not in source code", + "control_id": "V3.6.1", + "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.", "tier": "Foundational", "scope": "Both", "notes": "System prompts not hardcoded in source code — stored in secret management system", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM09.json b/data/entries/LLM09.json index b03ab20..1ec21d4 100644 --- a/data/entries/LLM09.json +++ b/data/entries/LLM09.json @@ -227,31 +227,34 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify least privilege access control on data", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Hardening", "scope": "Both", "notes": "RBAC on all vector store collections — no unauthenticated access", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify all sensitive data encrypted at rest", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Hardening", "scope": "Both", "notes": "All vector store content encrypted at rest", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", - "control_name": "Verify file upload malware scanning", + "control_id": "V5.2.1", + "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", "tier": "Hardening", "scope": "Both", "notes": "Content validation on all vector store ingestion — adversarial content detected", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM10.json b/data/entries/LLM10.json index 86e0a1e..f453e11 100644 --- a/data/entries/LLM10.json +++ b/data/entries/LLM10.json @@ -227,51 +227,56 @@ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding of untrusted data in HTML context", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "LLM responses rendered in browser contexts encoded against XSS", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.5", - "control_name": "Verify output encoding in SQL query context", + "control_id": "V1.2.4", + "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify output encoding in OS command context", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated commands validated — never raw output in shell context", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.4", - "control_name": "Verify application does not use eval or dynamic code", + "control_id": "V1.3.2", + "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.", "tier": "Foundational", "scope": "Both", "notes": "No eval or dynamic code execution of LLM-generated content", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.2.2", - "control_name": "Verify anti-CSRF tokens in state-changing operations", + "control_id": "V3.5.1", + "control_name": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).", "tier": "Foundational", "scope": "Both", "notes": "CSRF protection on endpoints where LLM output triggers state changes", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/framework-sources.json b/data/framework-sources.json index 37408a4..451a128 100644 --- a/data/framework-sources.json +++ b/data/framework-sources.json @@ -164,11 +164,11 @@ }, "owasp-asvs": { "name": "OWASP ASVS 4.0.3", - "mapped_version": "4.0.3", + "mapped_version": "5.0.0", "current_version": "5.0.0", - "checked": "2026-08-28", + "checked": "2026-09-18", "source_url": "https://owasp.org/projects/asvs", - "notes": "Verified via the OWASP/ASVS releases API (tag v5.0.0_release). Renumbered — re-map tracked in issue #22, NOT a version bump." + "notes": "Identifiers translated from 4.0.3 with the ASVS project's own 5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml; requirement text from the v5.0.0 release. Mechanical translation — relationship, rationale type and confidence on every row read DRAFT pending ASVS-leadership review (issue #22, STRAT-04). 11 identifiers 5.0.0 deleted are retained at 4.0.3 and flagged; see docs/ASVS_4_TO_5_TRANSLATION.md." }, "owasp-nhi": { "name": "OWASP NHI Top 10", diff --git a/data/frameworks/owasp-asvs.json b/data/frameworks/owasp-asvs.json index 50e0d00..d5e0768 100644 --- a/data/frameworks/owasp-asvs.json +++ b/data/frameworks/owasp-asvs.json @@ -2,585 +2,647 @@ "id": "owasp-asvs", "name": "OWASP ASVS 4.0.3", "short_name": "ASVS", - "version": "4.0.3", + "version": "5.0.0", "url": "https://owasp.org/projects/asvs", "license": "CC BY-SA 4.0", "publisher": "OWASP", "category": "appsec", - "last_synced": "2026-04-10", + "last_synced": "2026-09-18", "source_sha": null, "controls": [ { "control_id": "V1", - "title": "Architecture, Design and Threat Modeling", - "description": "Ensure a verified application satisfies high-level security architecture requirements.", + "title": "Encoding and Sanitization", + "description": "", "parent": null, - "function": "Architecture", - "kind": "control" - }, - { - "control_id": "V1.1", - "title": "Secure Software Development Lifecycle", - "description": "Ensure the use of a secure software development lifecycle that addresses security in all stages.", - "parent": "V1", - "function": "Architecture", + "function": "Encoding and Sanitization", "kind": "control" }, { "control_id": "V1.1.2", "title": "Threat modelling of all data flows", "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented", - "kind": "control" + "parent": null, + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { "control_id": "V1.1.4", "title": "Trust boundaries documented and enforced", + "description": "", + "parent": "V1", + "function": null, "kind": "control", - "parent": "V1" + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { "control_id": "V1.2", - "title": "Authentication Architecture", - "description": "Verify that authentication is addressed in the architecture.", + "title": "Injection Prevention", + "description": "", "parent": "V1", - "function": "Architecture", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V1.4", - "title": "Access Control Architecture", - "description": "Verify that access controls are applied consistently.", - "parent": "V1", - "function": "Architecture", + "control_id": "V1.2.4", + "title": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.", + "description": "", + "parent": "V1.2", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V1.5", - "title": "Input and Output Architecture", - "description": "Verify that input and output requirements define handling of data based on type and content.", + "control_id": "V1.3", + "title": "Sanitization", + "description": "", "parent": "V1", - "function": "Architecture", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2", - "title": "Authentication", - "description": "Verify that the application uses appropriate authentication mechanisms.", - "parent": null, - "function": "Verification", + "control_id": "V1.3.1", + "title": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.1", - "title": "Password Security", - "description": "Verify password requirements align with modern standards.", - "parent": "V2", - "function": "Verification", + "control_id": "V1.3.2", + "title": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.1.1", - "title": "Verify credentials not in source code", - "description": "Agent credentials not hardcoded — secret manager required", + "control_id": "V1.3.5", + "title": "Verify that the application sanitizes or disables user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode, or similar.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.5", - "title": "Credential Recovery", - "description": "Verify credential recovery mechanisms are secure.", - "parent": "V2", - "function": "Verification", + "control_id": "V1.3.6", + "title": "Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by validating untrusted data against an allowlist of protocols, domains, paths and ports and sanitizing potentially dangerous characters before using the data to call another service.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.8", - "title": "One Time Verifier", - "description": "Verify one-time passwords and verifiers are secure.", - "parent": "V2", - "function": "Verification", + "control_id": "V1.3.7", + "title": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.10.1", - "title": "Integration secrets not hardcoded", + "control_id": "V1.5", + "title": "Safe Deserialization", "description": "", - "parent": "V2", + "parent": "V1", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V3", - "title": "Session Management", - "description": "Verify the application has adequate session management controls.", - "parent": null, - "function": "Verification", + "control_id": "V1.5.3", + "title": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks.", + "description": "", + "parent": "V1.5", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V3.1.1", - "title": "Session tokens unique and random", - "kind": "control", - "parent": "V3" - }, - { - "control_id": "V3.3.1", - "title": "Verify anti-replay tokens in state-changing operations", - "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", + "control_id": "V2", + "title": "Validation and Business Logic", + "description": "", + "parent": null, + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4", - "title": "Access Control", - "description": "Verify that users can only access functions and data for which they possess specific authorization.", - "parent": null, - "function": "Verification", + "control_id": "V2.2", + "title": "Input Validation", + "description": "", + "parent": "V2", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1", - "title": "General Access Control Design", - "description": "Verify access control is applied server-side and consistently.", - "parent": "V4", - "function": "Verification", + "control_id": "V2.2.1", + "title": "Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input.", + "description": "", + "parent": "V2.2", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1.1", - "title": "Verify all sensitive functions have access control", - "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "control_id": "V2.3", + "title": "Business Logic Security", + "description": "", + "parent": "V2", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1.2", - "title": "Least privilege for service accounts", + "control_id": "V2.3.1", + "title": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "description": "", - "parent": "V4", + "parent": "V2.3", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1.3", - "title": "Verify access control enforces least privilege", - "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write", + "control_id": "V2.4", + "title": "Anti-automation", + "description": "", + "parent": "V2", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1.5", - "title": "Access control failures logged", + "control_id": "V2.4.1", + "title": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.", "description": "", - "parent": "V4", + "parent": "V2.4", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.2", - "title": "Operation Level Access Control", - "description": "Verify access controls at the operation and function level.", - "parent": "V4", - "function": "Verification", + "control_id": "V2.4.2", + "title": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", + "description": "", + "parent": "V2.4", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.2.2", - "title": "Verify anti-CSRF tokens in state-changing operations", - "description": "CSRF protection on endpoints where LLM output triggers state changes", + "control_id": "V3", + "title": "Web Frontend Security", + "description": "", + "parent": null, + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5", - "title": "Validation, Sanitization and Encoding", - "description": "Verify that the application sanitizes, validates, and encodes untrusted input.", - "parent": null, - "function": "Verification", + "control_id": "V3.5", + "title": "Browser Origin Separation", + "description": "", + "parent": "V3", + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5.1", - "title": "Input Validation", - "description": "Verify input validation controls are in place.", - "parent": "V5", - "function": "Verification", + "control_id": "V3.5.1", + "title": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).", + "description": "", + "parent": "V3.5", + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5.1.1", - "title": "Verify all user input validated against allowlist", - "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope", + "control_id": "V3.6", + "title": "External Resource Integrity", + "description": "", + "parent": "V3", + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5.1.2", - "title": "Verify that HTTP request parts are validated, sanitised, or rejected", - "description": "LLM API request validation — prompt structure, content type, and character set enforced", + "control_id": "V3.6.1", + "title": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.", + "description": "", + "parent": "V3.6", + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5.1.3", - "title": "Input validation server-side", + "control_id": "V5", + "title": "File Handling", "description": "", - "parent": "V5", + "parent": null, + "function": "File Handling", "kind": "control" }, { "control_id": "V5.2", - "title": "Sanitization and Sandboxing", - "description": "Verify that sanitization and sandboxing are used to prevent injection.", + "title": "File Upload and Content", + "description": "", "parent": "V5", - "function": "Verification", + "function": "File Handling", "kind": "control" }, { "control_id": "V5.2.1", - "title": "Verify output encoding prevents injection", - "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", + "title": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", + "description": "", + "parent": "V5.2", + "function": "File Handling", "kind": "control" }, { "control_id": "V5.2.4", - "title": "Verify application does not use eval or dynamic code", - "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", + "title": "Verify that a file size quota and maximum number of files per user are enforced to ensure that a single user cannot fill up the storage with too many files, or excessively large files.", + "description": "", + "parent": "V5.2", + "function": "File Handling", "kind": "control" }, { - "control_id": "V5.2.5", - "title": "Verify application protects against OS command injection", - "description": "Agent-generated instructions not executed in system context without validation; Agent-generated commands validated before any shell execution; LLM-generated content validated before execution in any shell or interpreter context", + "control_id": "V6", + "title": "Authentication", + "description": "", + "parent": null, + "function": "Authentication", "kind": "control" }, { - "control_id": "V5.2.6", - "title": "Defined output structure", + "control_id": "V6.2", + "title": "Password Security", "description": "", - "parent": "V5", + "parent": "V6", + "function": "Authentication", "kind": "control" }, { - "control_id": "V5.2.8", - "title": "Output encoding for context", - "kind": "control", - "parent": "V5" - }, - { - "control_id": "V5.3", - "title": "Output Encoding and Injection Prevention", - "description": "Verify that output encoding prevents injection attacks.", - "parent": "V5", - "function": "Verification", + "control_id": "V6.2.1", + "title": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.", + "description": "", + "parent": "V6.2", + "function": "Authentication", "kind": "control" }, { - "control_id": "V5.3.4", - "title": "SQL injection prevention", + "control_id": "V7", + "title": "Session Management", "description": "", - "parent": "V5", + "parent": null, + "function": "Session Management", "kind": "control" }, { - "control_id": "V5.3.5", - "title": "Verify output encoding in SQL context", - "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context", + "control_id": "V7.4", + "title": "Session Termination", + "description": "", + "parent": "V7", + "function": "Session Management", "kind": "control" }, { - "control_id": "V5.5", - "title": "Deserialization Prevention", - "description": "Verify that deserialization is done safely.", - "parent": "V5", - "function": "Verification", + "control_id": "V7.4.1", + "title": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.", + "description": "", + "parent": "V7.4", + "function": "Session Management", "kind": "control" }, { - "control_id": "V6", - "title": "Stored Cryptography", - "description": "Verify that cryptographic modules and algorithms are used correctly.", + "control_id": "V8", + "title": "Authorization", + "description": "", "parent": null, - "function": "Verification", + "function": "Authorization", "kind": "control" }, { - "control_id": "V6.1.1", - "title": "Verify sensitive data encrypted at rest", - "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", - "kind": "control" - }, - { - "control_id": "V7", - "title": "Error Handling and Logging", - "description": "Verify that errors are handled safely and logs contain sufficient information.", - "parent": null, - "function": "Verification", - "kind": "control" + "control_id": "V8.1.3", + "title": "Sensitive data not in session storage", + "description": "", + "parent": "V8", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, INSUFFICIENT IMPACT)" }, { - "control_id": "V7.1", - "title": "Log Content", - "description": "Verify that security-relevant events are logged.", - "parent": "V7", - "function": "Verification", - "kind": "control" + "control_id": "V8.1.4", + "title": "Sensitive data minimisation", + "description": "", + "parent": "V8", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { - "control_id": "V7.1.1", - "title": "No credential logging", + "control_id": "V8.2", + "title": "General Authorization Design", "description": "", - "parent": "V7", + "parent": "V8", + "function": "Authorization", "kind": "control" }, { - "control_id": "V7.1.2", - "title": "No sensitive data in logs", + "control_id": "V8.2.1", + "title": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "description": "", - "parent": "V7", + "parent": "V8.2", + "function": "Authorization", "kind": "control" }, { - "control_id": "V7.2", - "title": "Log Processing", - "description": "Verify that logs are processed securely.", - "parent": "V7", - "function": "Verification", + "control_id": "V8.3", + "title": "Operation Level Authorization", + "description": "", + "parent": "V8", + "function": "Authorization", "kind": "control" }, { - "control_id": "V7.2.1", - "title": "Verify access control decisions logged", - "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability", + "control_id": "V8.3.1", + "title": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.", + "description": "", + "parent": "V8.3", + "function": "Authorization", "kind": "control" }, { - "control_id": "V7.2.2", - "title": "Verify all business logic decisions logged", - "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable", - "kind": "control" + "control_id": "V8.3.3", + "title": "Consent obtained before PI processing", + "description": "", + "parent": "V8", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { - "control_id": "V7.4.1", - "title": "Verify error handling does not expose sensitive data", - "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", - "kind": "control" + "control_id": "V8.3.10", + "title": "Personal data not kept longer than needed", + "description": "", + "parent": "V8", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 ((id absent from the official 4.0.3 mapping))" }, { - "control_id": "V8", - "title": "Data Protection", - "description": "Verify that data is protected in transit and at rest.", + "control_id": "V10.2.1", + "title": "Verify third-party components current and free of vulnerabilities", + "description": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained; Training pipeline components scanned — compromised dependencies rejected", "parent": null, - "function": "Verification", - "kind": "control" + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT PRACTICAL)" }, { - "control_id": "V8.1", - "title": "General Data Protection", - "description": "Verify sensitive data is identified and protected.", - "parent": "V8", - "function": "Verification", - "kind": "control" + "control_id": "V10.2.2", + "title": "Verify only minimal approved external libraries", + "description": "Approved component list — unsigned or unverified agent components rejected; Approved component list for LLM deployments — unsigned or unverified components rejected", + "parent": null, + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT PRACTICAL)" }, { - "control_id": "V8.1.1", - "title": "Verify sensitive data is not cached or exposed in logs", - "description": "LLM outputs containing sensitive data not logged in cleartext or cached without protection; System prompts not stored in cleartext application configuration or source code", - "kind": "control" + "control_id": "V11.1.7", + "title": "Anti-automation controls", + "description": "", + "parent": "V11", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { - "control_id": "V8.1.3", - "title": "Sensitive data not in session storage", + "control_id": "V12", + "title": "Secure Communication", "description": "", - "parent": "V8", + "parent": null, + "function": "Secure Communication", "kind": "control" }, { - "control_id": "V8.1.4", - "title": "Sensitive data minimisation", + "control_id": "V12.2", + "title": "HTTPS Communication with External Facing Services", "description": "", - "parent": "V8", + "parent": "V12", + "function": "Secure Communication", "kind": "control" }, { - "control_id": "V8.3", - "title": "Sensitive Private Data", - "description": "Verify that sensitive data is protected from unauthorized access.", - "parent": "V8", - "function": "Verification", + "control_id": "V12.2.1", + "title": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.", + "description": "", + "parent": "V12.2", + "function": "Secure Communication", "kind": "control" }, { - "control_id": "V8.3.3", - "title": "Consent obtained before PI processing", + "control_id": "V13", + "title": "Configuration", "description": "", - "parent": "V8", + "parent": null, + "function": "Configuration", "kind": "control" }, { - "control_id": "V8.3.4", - "title": "Verify PII is identified and protected", - "description": "PII in LLM training data, RAG sources, and outputs identified and handled per policy", - "kind": "control" + "control_id": "V13.1.2", + "title": "API throttling", + "description": "", + "parent": "V13", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 ((id absent from the official 4.0.3 mapping))" }, { - "control_id": "V8.3.7", - "title": "Data transferred using current TLS", + "control_id": "V13.2", + "title": "Backend Communication Configuration", "description": "", - "parent": "V8", + "parent": "V13", + "function": "Configuration", "kind": "control" }, { - "control_id": "V8.3.10", - "title": "Personal data not kept longer than needed", + "control_id": "V13.2.1", + "title": "Verify that communications between backend application components that don't support the application's standard user session mechanism, including APIs, middleware, and data layers, are authenticated. Authentication must use individual service accounts, short-term tokens, or certificate-based authentication and not unchanging credentials such as passwords, API keys, or shared accounts with privileged access.", "description": "", - "parent": "V8", + "parent": "V13.2", + "function": "Configuration", "kind": "control" }, { - "control_id": "V9", - "title": "Communication", - "description": "Verify that communications are encrypted using TLS.", - "parent": null, - "function": "Verification", + "control_id": "V13.4", + "title": "Unintended Information Leakage", + "description": "", + "parent": "V13", + "function": "Configuration", "kind": "control" }, { - "control_id": "V9.1.1", - "title": "Verify TLS used for all client connectivity", - "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", + "control_id": "V13.4.5", + "title": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.", + "description": "", + "parent": "V13.4", + "function": "Configuration", "kind": "control" }, { - "control_id": "V10", - "title": "Malicious Code", - "description": "Verify that code does not contain malicious logic.", + "control_id": "V14", + "title": "Data Protection", + "description": "", "parent": null, - "function": "Verification", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V10.2.1", - "title": "Verify third-party components current and free of vulnerabilities", - "description": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained; Training pipeline components scanned — compromised dependencies rejected", + "control_id": "V14.1", + "title": "Data Protection Documentation", + "description": "", + "parent": "V14", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V10.2.2", - "title": "Verify only minimal approved external libraries", - "description": "Approved component list — unsigned or unverified agent components rejected; Approved component list for LLM deployments — unsigned or unverified components rejected", + "control_id": "V14.1.1", + "title": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", + "description": "", + "parent": "V14.1", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11", - "title": "Business Logic", - "description": "Verify that business logic flows are sequential and audited.", - "parent": null, - "function": "Verification", + "control_id": "V14.1.2", + "title": "Verify that all sensitive data protection levels have a documented set of protection requirements. This must include (but not be limited to) requirements related to general encryption, integrity verification, retention, how the data is to be logged, access controls around sensitive data in logs, database-level encryption, privacy and privacy-enhancing technologies to be used, and other confidentiality requirements.", + "description": "", + "parent": "V14.1", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11.1.1", - "title": "Verify business logic assumptions documented", - "description": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted; AI advisory limitations documented as business logic assumptions — verification requirements per domain; LLM accuracy limitations documented as business logic assumptions — verification requirements defined", - "kind": "control" + "control_id": "V14.1.4", + "title": "All components inventoried", + "description": "", + "parent": "V14", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { - "control_id": "V11.1.2", - "title": "Verify business logic limits prevent function abuse", - "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", + "control_id": "V14.2", + "title": "General Data Protection", + "description": "", + "parent": "V14", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11.1.4", - "title": "Verify business logic rate limits", - "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", + "control_id": "V14.2.1", + "title": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.", + "description": "", + "parent": "V14.2", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11.1.5", - "title": "Business logic prevents excess data access", + "control_id": "V14.2.2", + "title": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.", "description": "", - "parent": "V11", + "parent": "V14.2", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11.1.7", - "title": "Anti-automation controls", + "control_id": "V15", + "title": "Secure Coding and Architecture", "description": "", - "parent": "V11", + "parent": null, + "function": "Secure Coding and Architecture", "kind": "control" }, { - "control_id": "V12", - "title": "Files and Resources", - "description": "Verify that untrusted files and resources are handled safely.", - "parent": null, - "function": "Verification", + "control_id": "V15.3", + "title": "Defensive Coding", + "description": "", + "parent": "V15", + "function": "Secure Coding and Architecture", "kind": "control" }, { - "control_id": "V12.1.1", - "title": "Verify file upload malware scanning", - "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected", + "control_id": "V15.3.3", + "title": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.", + "description": "", + "parent": "V15.3", + "function": "Secure Coding and Architecture", "kind": "control" }, { - "control_id": "V12.1.3", - "title": "Malicious file detection on upload", + "control_id": "V15.3.7", + "title": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "description": "", - "parent": "V12", + "parent": "V15.3", + "function": "Secure Coding and Architecture", "kind": "control" }, { - "control_id": "V13", - "title": "API and Web Service", - "description": "Verify that API and web service requests are validated.", + "control_id": "V16", + "title": "Security Logging and Error Handling", + "description": "", "parent": null, - "function": "Verification", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V13.1", - "title": "Generic Web Service Security", - "description": "Verify that all API and web service interactions are authenticated and authorized.", - "parent": "V13", - "function": "Verification", + "control_id": "V16.2", + "title": "General Logging", + "description": "", + "parent": "V16", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V13.1.1", - "title": "Verify API rate limiting", - "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", + "control_id": "V16.2.5", + "title": "Verify that when logging sensitive data, the application enforces logging based on the data's protection level. For example, it may not be allowed to log certain data, such as credentials or payment details. Other data, such as session tokens, may only be logged by being hashed or masked, either in full or partially.", + "description": "", + "parent": "V16.2", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V13.1.2", - "title": "API throttling", + "control_id": "V16.3", + "title": "Security Events", "description": "", - "parent": "V13", + "parent": "V16", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V13.1.3", - "title": "Verify API rejects large unexpected payloads", - "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", + "control_id": "V16.3.1", + "title": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", + "description": "", + "parent": "V16.3", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V14", - "title": "Configuration", - "description": "Verify that the application is securely configured.", - "parent": null, - "function": "Verification", + "control_id": "V16.3.2", + "title": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", + "description": "", + "parent": "V16.3", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V14.1.4", - "title": "All components inventoried", - "kind": "control", - "parent": "V14" + "control_id": "V16.5", + "title": "Error Handling", + "description": "", + "parent": "V16", + "function": "Security Logging and Error Handling", + "kind": "control" }, { - "control_id": "V14.2.2", - "title": "Verify build pipelines include security checks", - "description": "CI/CD pipeline for agent components includes integrity verification and CVE scanning; CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning", + "control_id": "V16.5.1", + "title": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", + "description": "", + "parent": "V16.5", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V14.2.3", - "title": "Verify secrets not in source code", - "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system", + "control_id": "V16.5.3", + "title": "Verify that the application fails gracefully and securely, including when an exception occurs, preventing fail-open conditions such as processing a transaction despite errors resulting from validation logic.", + "description": "", + "parent": "V16.5", + "function": "Security Logging and Error Handling", "kind": "control" } ], @@ -594,13 +656,23 @@ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 75 items -> 82, including 17 referenced by mappings but absent from the registry", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Re-mapped to ASVS 5.0.0 using the project's own mapping_v4.0.3_to_v5.0.0.yml: 82 items -> 78, titles from the 5.0.0 release; 11 id(s) 5.0.0 deleted are kept and flagged (#22)", + "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Re-mapped to ASVS 5.0.0 using the project's own mapping_v4.0.3_to_v5.0.0.yml: 78 items -> 78, titles from the 5.0.0 release; 11 id(s) 5.0.0 deleted are kept and flagged (#22)", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { - "status": "unknown", - "included": 82, - "total": null, - "note": "Authoritative control count not established. Needs a count from the published framework.", - "source": "https://owasp.org/projects/asvs" + "status": "partial", + "included": 78, + "total": 345, + "note": "Holds the 44 requirement(s) the mappings cite plus their sections and chapters, titled from the ASVS 5.0.0 release. The standard has 345 requirements in total; the rest are not referenced by this crosswalk. 11 id(s) remain at 4.0.3 because 5.0.0 deleted them — see issue #22.", + "source": "https://github.com/OWASP/ASVS/releases/tag/v5.0.0_release" } } diff --git a/data/stats.json b/data/stats.json index d6b91d2..6f5e69c 100644 --- a/data/stats.json +++ b/data/stats.json @@ -74,8 +74,8 @@ }, "freshness": { "checked": 5, - "current": 3, - "diverged": 2, + "current": 4, + "diverged": 1, "unchecked": 21, "diverged_frameworks": [ { @@ -83,20 +83,14 @@ "mapped": "4.0", "current": "2026.09", "checked": "2026-09-17" - }, - { - "name": "OWASP ASVS 4.0.3", - "mapped": "4.0.3", - "current": "5.0.0", - "checked": "2026-08-28" } ] }, "controls": { - "total": 998, - "registry_items": 1132, + "total": 994, + "registry_items": 1128, "by_kind": { - "control": 998, + "control": 994, "layer": 10, "technique": 57, "threat-category": 6, diff --git a/docs/ASVS_4_TO_5_TRANSLATION.md b/docs/ASVS_4_TO_5_TRANSLATION.md new file mode 100644 index 0000000..acecbfd --- /dev/null +++ b/docs/ASVS_4_TO_5_TRANSLATION.md @@ -0,0 +1,110 @@ + + +# ASVS 4.0.3 → 5.0.0 translation + +Every ASVS identifier this crosswalk cites, and what the **ASVS project’s own mapping +file** says became of it in 5.0.0. Nothing here is our judgment: the disposition column +is quoted from [`mapping_v4.0.3_to_v5.0.0.yml`][official], and the 5.0.0 requirement text +is from the [v5.0.0 release][release]. + +[official]: https://github.com/OWASP/ASVS/blob/master/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml +[release]: https://github.com/OWASP/ASVS/releases/tag/v5.0.0_release + +| | | +|---|--:| +| Identifiers cited by this crosswalk | 50 | +| Mapping rows they cover | 151 | +| **Translated to a 5.0.0 identifier** | **39 ids / 127 rows** | +| **Retained at 4.0.3 — 5.0.0 has no successor** | **11 ids / 24 rows** | + +Dispositions seen: + +- `modified` × 16 +- `moved` × 12 +- `deleted` × 9 +- `merged` × 6 +- `covered-by` × 3 +- `not-in-official-mapping` × 2 +- `other` × 1 +- `split` × 1 + +## Translated + +The requirement text on each row was replaced with 5.0.0’s own wording. Where the official +file records a **split**, the row takes the first target and the full disposition is recorded +here — an SME decides whether the second target deserves its own row. + +| 4.0.3 | → 5.0.0 | Official disposition | Rows | Entries | +|---|---|---|--:|---| +| `V2.1.1` | `V6.2.1` | MODIFIED, MOVED TO v5.0.0-6.2.1 | 3 | ASI03, DSGAI02, DSGAI19 | +| `V2.10.1` | `V13.2.1` | MOVED TO v5.0.0-13.2.1 | 1 | DSGAI02 | +| `V3.1.1` | `V14.2.1` | DELETED, MERGED TO v5.0.0-14.2.1 | 2 | DSGAI11, DSGAI15 | +| `V3.3.1` | `V7.4.1` | MOVED TO v5.0.0-7.4.1 | 2 | ASI07, DSGAI11 | +| `V4.1.1` | `V8.3.1` | MOVED TO v5.0.0-8.3.1 | 7 | ASI02, DSGAI06, DSGAI11, DSGAI12, DSGAI14, DSGAI20, LLM03 | +| `V4.1.2` | `V8.2.1` | DELETED, COVERED BY v5.0.0-8.2.1 | 3 | DSGAI02, DSGAI16, DSGAI19 | +| `V4.1.3` | `V8.2.1` | MODIFIED, MOVED TO v5.0.0-8.2.1 | 11 | ASI02, ASI03, ASI06, ASI07, DSGAI01, DSGAI13, DSGAI15, LLM02, LLM03, LLM08, LLM09 | +| `V4.1.5` | `V16.5.3` | MOVED TO v5.0.0-16.5.3 | 2 | DSGAI03, DSGAI07 | +| `V4.2.2` | `V3.5.1` | MOVED TO v5.0.0-3.5.1 | 1 | LLM10 | +| `V5.1.1` | `V15.3.7` | MOVED TO v5.0.0-15.3.7 | 6 | ASI01, ASI06, DSGAI05, DSGAI12, LLM01, LLM05 | +| `V5.1.2` | `V15.3.3` | MOVED TO v5.0.0-15.3.3 | 1 | LLM01 | +| `V5.1.3` | `V2.2.1` | MOVED TO v5.0.0-2.2.1 | 2 | DSGAI04, DSGAI21 | +| `V5.2.1` | `V1.3.1` | MODIFIED, MOVED TO v5.0.0-1.3.1 | 7 | ASI01, ASI05, ASI09, DSGAI05, LLM01, LLM07, LLM10 | +| `V5.2.4` | `V1.3.2` | MODIFIED, MOVED TO v5.0.0-1.3.2 | 2 | ASI05, LLM10 | +| `V5.2.5` | `V1.3.7` | MODIFIED, MOVED TO v5.0.0-1.3.7 | 5 | ASI01, ASI05, DSGAI09, LLM01, LLM10 | +| `V5.2.6` | `V1.3.6` | MODIFIED, MOVED TO v5.0.0-1.3.6 | 1 | DSGAI10 | +| `V5.2.8` | `V1.3.5` | MODIFIED, MOVED TO v5.0.0-1.3.5 | 1 | DSGAI01 | +| `V5.3.4` | `V1.2.4` | MODIFIED, MOVED TO v5.0.0-1.2.4 | 1 | DSGAI12 | +| `V5.3.5` | `V1.2.4` | DELETED, COVERED BY v5.0.0-1.2.4 | 2 | ASI05, LLM10 | +| `V6.1.1` | `V14.1.1` | DELETED, MERGED TO v5.0.0-14.1.1 | 7 | ASI03, ASI06, DSGAI01, DSGAI13, DSGAI18, LLM02, LLM09 | +| `V7.1.1` | `V16.2.5` | MODIFIED, MOVED TO v5.0.0-16.2.5 | 1 | DSGAI14 | +| `V7.1.2` | `V16.2.5` | DELETED, MERGED TO v5.0.0-16.2.5 | 1 | DSGAI14 | +| `V7.2.1` | `V16.3.1` | MODIFIED, MOVED TO v5.0.0-16.3.1 | 4 | ASI03, ASI07, ASI10, LLM08 | +| `V7.2.2` | `V16.3.2` | MODIFIED, MOVED TO v5.0.0-16.3.2 | 5 | ASI02, ASI10, DSGAI03, DSGAI08, LLM03 | +| `V7.4.1` | `V16.5.1` | MODIFIED, MOVED TO v5.0.0-16.5.1 | 5 | ASI08, ASI09, DSGAI05, LLM06, LLM07 | +| `V8.1.1` | `V14.2.2` | MODIFIED, MOVED TO v5.0.0-14.2.2 | 4 | DSGAI01, DSGAI14, LLM02, LLM08 | +| `V8.3.4` | `V14.1.1` | DELETED, MERGED TO v5.0.0-14.1.1 | 5 | DSGAI01, DSGAI07, DSGAI10, DSGAI18, LLM02 | +| `V8.3.7` | `V14.1.2` | DELETED, COVERED BY v5.0.0-14.1.2 | 1 | DSGAI02 | +| `V9.1.1` | `V12.2.1` | MODIFIED, MOVED TO v5.0.0-12.2.1 | 3 | ASI07, DSGAI06, LLM02 | +| `V11.1.1` | `V2.3.1` | MODIFIED, MOVED TO v5.0.0-2.3.1 | 3 | ASI08, ASI09, LLM07 | +| `V11.1.2` | `V2.4.2` | MOVED TO v5.0.0-2.4.2 | 7 | ASI01, ASI02, ASI05, ASI08, ASI10, LLM01, LLM03 | +| `V11.1.4` | `V2.4.1` | MOVED TO v5.0.0-2.4.1 | 3 | DSGAI06, DSGAI21, LLM06 | +| `V11.1.5` | `V2.2.1` | DELETED, MERGED TO v5.0.0-2.2.1 | 1 | DSGAI16 | +| `V12.1.1` | `V5.2.1` | MODIFIED, MOVED TO v5.0.0-5.2.1 | 5 | ASI06, DSGAI04, DSGAI13, LLM05, LLM09 | +| `V12.1.3` | `V5.2.4` | GRAMMAR, MOVED TO v5.0.0-5.2.4 | 1 | DSGAI09 | +| `V13.1.1` | `V1.5.3` | MOVED TO v5.0.0-1.5.3 | 5 | ASI02, ASI08, ASI10, DSGAI12, LLM06 | +| `V13.1.3` | `V14.2.1` | DELETED, MERGED TO v5.0.0-14.2.1 | 2 | ASI09, LLM06 | +| `V14.2.2` | `V13.4.5` | SPLIT TO v5.0.0-13.4.5, v5.0.0-15.2.3 | 2 | ASI04, LLM04 | +| `V14.2.3` | `V3.6.1` | MOVED TO v5.0.0-3.6.1 | 2 | ASI03, LLM08 | + +## Retained at 4.0.3 — no 5.0.0 successor + +These rows keep their 4.0.3 identifier and carry a DRAFT marker naming the disposition. +They are **not** silently renumbered: several of these numbers exist in 5.0.0 as an entirely +different requirement, so reusing them would assert a mapping nobody made. + +| 4.0.3 | Official disposition | Rows | Entries | +|---|---|--:|---| +| `V1.1.2` | DELETED, NOT IN SCOPE | 4 | ASI01, ASI04, DSGAI16, LLM01 | +| `V1.1.4` | DELETED, NOT IN SCOPE | 1 | DSGAI03 | +| `V8.1.3` | DELETED, INSUFFICIENT IMPACT | 1 | DSGAI11 | +| `V8.1.4` | DELETED, NOT IN SCOPE | 4 | DSGAI07, DSGAI09, DSGAI15, DSGAI20 | +| `V8.3.3` | DELETED, NOT IN SCOPE | 2 | DSGAI08, DSGAI19 | +| `V8.3.10` | (id absent from the official 4.0.3 mapping) | 1 | DSGAI08 | +| `V10.2.1` | DELETED, NOT PRACTICAL | 4 | ASI04, DSGAI04, LLM04, LLM05 | +| `V10.2.2` | DELETED, NOT PRACTICAL | 4 | ASI04, DSGAI04, DSGAI20, LLM04 | +| `V11.1.7` | DELETED, NOT IN SCOPE | 1 | DSGAI17 | +| `V13.1.2` | (id absent from the official 4.0.3 mapping) | 1 | DSGAI17 | +| `V14.1.4` | DELETED, NOT IN SCOPE | 1 | DSGAI03 | + +## What still needs a human + +- The 11 retained identifiers above: retarget to a 5.0.0 requirement, or drop the row. +- **Every** translated row’s `relationship`, `rationale type` and `confidence`, all of + which read `DRAFT`. The identifier translation is mechanical; whether the 5.0.0 + requirement still addresses the GenAI risk the row claims is expert judgment (C4), + reviewed by an ASVS-leadership reviewer per STRAT-04. diff --git a/docs/backlinks.js b/docs/backlinks.js index 598e195..926b15b 100644 --- a/docs/backlinks.js +++ b/docs/backlinks.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Backlinks: 773 +// Backlinks: 767 window.CROSSWALK_BACKLINKS = [ { "framework": "AIUC-1", @@ -30540,7 +30540,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM data flows threat-modelled — all injection paths identified and documented" + "notes": "LLM data flows threat-modelled — all injection paths identified and documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "ASI01", @@ -30549,7 +30549,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All agent input sources threat-modelled — every indirect injection path documented" + "notes": "All agent input sources threat-modelled — every indirect injection path documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "ASI04", @@ -30558,7 +30558,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Supply chain threat model documents all agent component sources and trust levels" + "notes": "Supply chain threat model documents all agent component sources and trust levels — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "DSGAI16", @@ -30567,7 +30567,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, @@ -30583,101 +30583,58 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10.2.1", - "control_name": "Verify third-party components are current and free from vulnerabilities", + "control_id": "V1.2.4", + "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained" + "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context" }, { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Training pipeline components scanned — compromised dependencies rejected" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored" + "notes": "No raw agent output in SQL context — parameterised execution only" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", - "scope": "Both", + "tier": "Foundational", + "scope": "Build", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V10.2.2", - "control_name": "Verify only minimal approved external libraries are used", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "entries": [ { - "id": "LLM04", - "name": "Supply Chain", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected" - }, - { - "id": "ASI04", - "name": "Agentic Supply Chain", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Approved component list — unsigned or unverified agent components rejected" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "LLM output encoding before passing to downstream renderers or interpreters" }, - { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.1", - "control_name": "Verify business logic assumptions documented", - "entries": [ { "id": "LLM07", "name": "Misinformation", @@ -30685,50 +30642,16 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted" - }, - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent abuse of LLM functions", - "entries": [ - { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions" + "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source" }, { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Business logic controls preventing tool misuse through prompt manipulation" + "notes": "LLM responses rendered in browser contexts encoded against XSS" }, { "id": "ASI01", @@ -30737,16 +30660,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Business logic controls prevent injection from redirecting agent goal" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified" + "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted" }, { "id": "ASI05", @@ -30755,72 +30669,63 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis" + "notes": "Agent code output encoded before rendering in any context" }, { - "id": "ASI08", - "name": "Cascading Agent Failures", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Circuit breakers as business logic controls — cascade propagation limited by design" + "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content" }, { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope" + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.4", - "control_name": "Verify business logic rate limits", + "control_id": "V1.3.2", + "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null + "notes": "No eval or dynamic code execution of LLM-generated content" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.5", - "control_name": "Business logic prevents excess data access", + "control_id": "V1.3.5", + "control_name": "Output encoding for context", "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI01", + "name": "Sensitive Data Leakage", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null @@ -30829,77 +30734,61 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.7", - "control_name": "Anti-automation controls", + "control_id": "V1.3.6", + "control_name": "Defined output structure", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", - "control_name": "Verify file uploads scanned for malware", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "entries": [ { - "id": "LLM05", - "name": "Data and Model Poisoning", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Training data uploads scanned before ingestion — adversarial content detected" + "notes": "LLM-generated content validated before execution in any shell or interpreter context" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM10", + "name": "Improper Output Handling", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "Content validation on all vector store ingestion — adversarial content detected" + "notes": "LLM-generated commands validated — never raw output in shell context" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write" + "notes": "Agent-generated instructions not executed in system context without validation" }, { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Agent-generated commands validated before any shell execution" }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.3", - "control_name": "Malicious file detection on upload", - "entries": [ { "id": "DSGAI09", "name": "Multimodal Cross-Channel Leakage", @@ -30913,7 +30802,7 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "entries": [ { @@ -30923,7 +30812,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting on all LLM API endpoints — per user, per session, per API key" + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio" }, { "id": "ASI02", @@ -30932,7 +30821,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Tool API endpoints rate-limited — anomalous invocation frequency detected" + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio" }, { "id": "ASI08", @@ -30941,7 +30830,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited" + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio" }, { "id": "ASI10", @@ -30950,7 +30839,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion" + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio" }, { "id": "DSGAI12", @@ -30965,65 +30854,51 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.2", - "control_name": "API throttling", + "control_id": "V10.2.1", + "control_name": "Verify third-party components are current and free from vulnerabilities", "entries": [ { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.3", - "control_name": "Verify API rejects large unexpected payloads", - "entries": [ + "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" + }, { - "id": "LLM06", - "name": "Unbounded Consumption", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway" + "notes": "Training pipeline components scanned — compromised dependencies rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" }, { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI04", + "name": "Agentic Supply Chain", "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat" - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.1.4", - "control_name": "All components inventoried", - "entries": [ + "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" + }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.2", - "control_name": "Verify build pipelines include security checks", + "control_id": "V10.2.2", + "control_name": "Verify only minimal approved external libraries are used", "entries": [ { "id": "LLM04", @@ -31032,7 +30907,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning" + "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" }, { "id": "ASI04", @@ -31041,63 +30916,72 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "CI/CD pipeline for agent components includes integrity verification and CVE scanning" + "notes": "Approved component list — unsigned or unverified agent components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.3", - "control_name": "Verify secrets not in source code", + "control_id": "V11.1.7", + "control_name": "Anti-automation controls", "entries": [ { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "System prompts not hardcoded in source code — stored in secret management system" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credentials not committed to source control" + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", - "control_name": "Verify credentials not in source code", + "control_id": "V12.2.1", + "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.", "entries": [ { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials not hardcoded — secret manager required" + "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum" }, { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" }, { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", - "severity": "Medium", + "severity": "High", "tier": "Foundational", "scope": "Both", "notes": null @@ -31106,132 +30990,141 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.10.1", - "control_name": "Integration secrets not hardcoded", + "control_id": "V13.1.2", + "control_name": "API throttling", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.1.1", - "control_name": "Session tokens unique and random", + "control_id": "V13.2.1", + "control_name": "Integration secrets not hardcoded", "entries": [ { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null - }, - { - "id": "DSGAI15", - "name": "Over-Broad Context Windows", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.3.1", - "control_name": "Verify anti-replay tokens in state-changing operations", + "control_id": "V13.4.5", + "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.", "entries": [ { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", + "id": "LLM04", + "name": "Supply Chain", + "source_list": "LLM-Top10-2026", "severity": "High", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers" + "notes": "CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning" }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", - "source_list": "DSGAI-2026", + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "CI/CD pipeline for agent components includes integrity verification and CVE scanning" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", - "control_name": "Verify all sensitive functions have access control", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM02", + "name": "Sensitive Information Disclosure", "source_list": "LLM-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation" + "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "All vector store content encrypted at rest" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session" + "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", "notes": null }, { - "id": "DSGAI11", - "name": "Cross-Context Conversation Bleed", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", + "severity": "Medium", + "tier": "Hardening", "scope": "Build", "notes": null }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", + "scope": "Both", "notes": null }, { - "id": "DSGAI20", - "name": "Model Exfiltration and IP Replication", + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", @@ -31242,8 +31135,8 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.2", - "control_name": "Least privilege for service accounts", + "control_id": "V14.1.2", + "control_name": "Data transferred using current TLS", "entries": [ { "id": "DSGAI02", @@ -31253,120 +31146,55 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": null - }, + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V14.1.4", + "control_name": "All components inventoried", + "entries": [ { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control decisions enforce least privilege", + "control_id": "V14.2.1", + "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access" + "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway" }, { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM tool access enforced at minimum required scope — read-only by default" + "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "System prompt access restricted to authorised personnel — read access logged" - }, - { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", - "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Both", - "notes": "RBAC on all vector store collections — no unauthenticated access" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved" - }, - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent credential scope minimum required — no over-privileged NHIs" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "A2A channels enforce sender identity — unauthenticated messages rejected" - }, - { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": null - }, - { - "id": "DSGAI13", - "name": "Vector Store Platform Security", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null }, { @@ -31382,49 +31210,67 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.5", - "control_name": "Access control failures logged", + "control_id": "V14.2.2", + "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.", "entries": [ { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", + "notes": "System prompts not stored in cleartext application configuration or source code" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", "notes": null }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", - "scope": "Both", + "scope": "Build", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.2.2", - "control_name": "Verify anti-CSRF tokens in state-changing operations", + "control_id": "V15.3.3", + "control_name": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "CSRF protection on endpoints where LLM output triggers state changes" + "notes": "LLM API request validation — prompt structure, content type, and character set enforced" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all user input validated against an allowlist or rejected", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "entries": [ { "id": "LLM01", @@ -31484,94 +31330,146 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.2", - "control_name": "Verify that HTTP request parts are validated, sanitised, or rejected", + "control_id": "V16.2.5", + "control_name": "No credential logging", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", - "severity": "Critical", + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Foundational", - "scope": "Both", - "notes": "LLM API request validation — prompt structure, content type, and character set enforced" + "scope": "Build", + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.3", - "control_name": "Input validation server-side", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "entries": [ { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "All access to system prompts logged — unauthorised access attempts detectable" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "All credential usage logged — issuance, access, expiry detectable" }, { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "All A2A messages logged — sender identity, content hash, schema validation results" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "All agent actions logged — no production deployment without complete observability" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding prevents injection attacks", + "control_id": "V16.3.2", + "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM output encoding before passing to downstream renderers or interpreters" + "notes": "All LLM tool invocations logged with full context — every tool call auditable" }, { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source" + "notes": null }, { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", + "entries": [ + { + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM responses rendered in browser contexts encoded against XSS" + "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses" }, { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted" + "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Hardening", + "tier": "Foundational", "scope": "Both", - "notes": "Agent code output encoded before rendering in any context" + "notes": "Cascade errors handled gracefully — no sensitive system information in error responses" }, { "id": "ASI09", @@ -31580,7 +31478,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content" + "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable" }, { "id": "DSGAI05", @@ -31595,73 +31493,55 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.4", - "control_name": "Verify application does not use eval or dynamic code", + "control_id": "V16.5.3", + "control_name": "Access control failures logged", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "No eval or dynamic code execution of LLM-generated content" + "notes": null }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", "scope": "Both", - "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review" + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify application protects against OS command injection", + "control_id": "V2.2.1", + "control_name": "Input validation server-side", "entries": [ { - "id": "LLM01", - "name": "Prompt Injection", - "source_list": "LLM-Top10-2026", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "LLM-generated content validated before execution in any shell or interpreter context" + "notes": null }, { - "id": "LLM10", - "name": "Improper Output Handling", - "source_list": "LLM-Top10-2026", + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM-generated commands validated — never raw output in shell context" - }, - { - "id": "ASI01", - "name": "Agent Goal Hijack", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent-generated instructions not executed in system context without validation" - }, - { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Agent-generated commands validated before any shell execution" + "notes": null }, { - "id": "DSGAI09", - "name": "Multimodal Cross-Channel Leakage", + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", @@ -31672,183 +31552,162 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.6", - "control_name": "Defined output structure", + "control_id": "V2.3.1", + "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "entries": [ { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", - "scope": "Build", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.8", - "control_name": "Output encoding for context", - "entries": [ + "id": "LLM07", + "name": "Misinformation", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined" + }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.4", - "control_name": "SQL injection prevention", - "entries": [ + "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted" + }, { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.5", - "control_name": "Verify output encoding in SQL query context", + "control_id": "V2.4.1", + "control_name": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.", "entries": [ { - "id": "LLM10", - "name": "Improper Output Handling", + "id": "LLM06", + "name": "Unbounded Consumption", "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context" + "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies" }, { - "id": "ASI05", - "name": "Unexpected Code Execution", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "No raw agent output in SQL context — parameterised execution only" + "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify all sensitive data encrypted at rest", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM01", + "name": "Prompt Injection", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Training data, embeddings, RAG document stores, and prompt caches encrypted at rest" + "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions" }, { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "All vector store content encrypted at rest" + "notes": "Business logic controls preventing tool misuse through prompt manipulation" }, { - "id": "ASI03", - "name": "Identity and Privilege Abuse", + "id": "ASI01", + "name": "Agent Goal Hijack", "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory" + "notes": "Business logic controls prevent injection from redirecting agent goal" }, { - "id": "ASI06", - "name": "Memory and Context Poisoning", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", + "severity": "Critical", + "tier": "Foundational", "scope": "Both", - "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory" + "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis" }, { - "id": "DSGAI13", - "name": "Vector Store Platform Security", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Circuit breakers as business logic controls — cascade propagation limited by design" }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Hardening", "scope": "Both", - "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.1.1", - "control_name": "No credential logging", - "entries": [ - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": null + "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.1.2", - "control_name": "No sensitive data in logs", + "control_id": "V3.5.1", + "control_name": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).", "entries": [ { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", + "id": "LLM10", + "name": "Improper Output Handling", + "source_list": "LLM-Top10-2026", "severity": "High", "tier": "Foundational", - "scope": "Build", - "notes": null + "scope": "Both", + "notes": "CSRF protection on endpoints where LLM output triggers state changes" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify access control decisions logged", + "control_id": "V3.6.1", + "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.", "entries": [ { "id": "LLM08", @@ -31857,7 +31716,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All access to system prompts logged — unauthorised access attempts detectable" + "notes": "System prompts not hardcoded in source code — stored in secret management system" }, { "id": "ASI03", @@ -31866,72 +31725,54 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "All credential usage logged — issuance, access, expiry detectable" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A messages logged — sender identity, content hash, schema validation results" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "All agent actions logged — no production deployment without complete observability" + "notes": "Agent credentials not committed to source control" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", - "control_name": "Verify all business logic decisions logged", + "control_id": "V5.2.1", + "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", "entries": [ { - "id": "LLM03", - "name": "Excessive Agency", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", "severity": "Critical", - "tier": "Foundational", + "tier": "Hardening", "scope": "Both", - "notes": "All LLM tool invocations logged with full context — every tool call auditable" + "notes": "Training data uploads scanned before ingestion — adversarial content detected" }, { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", "scope": "Both", - "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp" + "notes": "Content validation on all vector store ingestion — adversarial content detected" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis" + "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write" }, { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", + "severity": "Critical", + "tier": "Hardening", "scope": "Both", "notes": null }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -31942,91 +31783,71 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify error handling does not expose sensitive data", + "control_id": "V5.2.4", + "control_name": "Malicious file detection on upload", "entries": [ { - "id": "LLM06", - "name": "Unbounded Consumption", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses" - }, - { - "id": "LLM07", - "name": "Misinformation", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality" - }, - { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Cascade errors handled gracefully — no sensitive system information in error responses" - }, - { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", + "severity": "High", + "tier": "Hardening", + "scope": "Both", "notes": null } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data is not cached or exposed in logs", + "control_id": "V6.2.1", + "control_name": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection" + "notes": "Agent credentials not hardcoded — secret manager required" }, { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "System prompts not stored in cleartext application configuration or source code" + "notes": null }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "Medium", "tier": "Foundational", "scope": "Both", "notes": null + } + ] + }, + { + "framework": "OWASP ASVS 4.0.3", + "control_id": "V7.4.1", + "control_name": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers" }, { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -32047,7 +31868,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": null + "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, INSUFFICIENT IMPACT; retarget or drop pending SME review (#22)**" } ] }, @@ -32063,7 +31884,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "DSGAI09", @@ -32072,7 +31893,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "DSGAI15", @@ -32081,7 +31902,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Foundational", "scope": "Build", - "notes": null + "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { "id": "DSGAI20", @@ -32090,34 +31911,126 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.10", - "control_name": "Personal data not kept longer than needed", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "entries": [ { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access" + }, + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "LLM tool access enforced at minimum required scope — read-only by default" + }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "System prompt access restricted to authorised personnel — read access logged" + }, + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "RBAC on all vector store collections — no unauthenticated access" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Agent credential scope minimum required — no over-privileged NHIs" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "A2A channels enforce sender identity — unauthenticated messages rejected" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": null + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", "notes": null - } - ] - }, - { - "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.3", - "control_name": "Consent obtained before PI processing", - "entries": [ + }, { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -32137,30 +32050,30 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", - "control_name": "Verify PII is identified and protected", + "control_id": "V8.3.1", + "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", + "id": "LLM03", + "name": "Excessive Agency", "source_list": "LLM-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy" + "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation" }, { - "id": "DSGAI01", - "name": "Sensitive Data Leakage", - "source_list": "DSGAI-2026", + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session" }, { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", @@ -32168,17 +32081,35 @@ window.CROSSWALK_BACKLINKS = [ "notes": null }, { - "id": "DSGAI10", - "name": "Synthetic Data and Anonymization Pitfalls", + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Hardening", + "severity": "High", + "tier": "Foundational", "scope": "Build", "notes": null }, { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": null + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", "source_list": "DSGAI-2026", "severity": "High", "tier": "Hardening", @@ -32189,51 +32120,42 @@ window.CROSSWALK_BACKLINKS = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.7", - "control_name": "Data transferred using current TLS", + "control_id": "V8.3.10", + "control_name": "Personal data not kept longer than needed", "entries": [ { - "id": "DSGAI02", - "name": "Agent Identity and Credential Exposure", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", "source_list": "DSGAI-2026", - "severity": "Critical", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**" } ] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", - "control_name": "Verify all sensitive data encrypted in transit", + "control_id": "V8.3.3", + "control_name": "Consent obtained before PI processing", "entries": [ { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages" + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" }, { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", "source_list": "DSGAI-2026", - "severity": "High", + "severity": "Medium", "tier": "Foundational", "scope": "Both", - "notes": null + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**" } ] }, diff --git a/docs/data.js b/docs/data.js index ae85b24..4d1b254 100644 --- a/docs/data.js +++ b/docs/data.js @@ -253,41 +253,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all user input validated against an allowlist or rejected", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "tier": "Foundational", "scope": "Both", "notes": "All inputs to LLMs validated — indirect injection through processed content equally in scope", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.2", - "control_name": "Verify that HTTP request parts are validated, sanitised, or rejected", + "control_id": "V15.3.3", + "control_name": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.", "tier": "Foundational", "scope": "Both", "notes": "LLM API request validation — prompt structure, content type, and character set enforced", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding prevents injection attacks", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "LLM output encoding before passing to downstream renderers or interpreters", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify application protects against OS command injection", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated content validated before execution in any shell or interpreter context", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -297,17 +301,19 @@ window.CROSSWALK_DATA = [ "control_name": "Threat modelling of all data flows", "tier": "Foundational", "scope": "Both", - "notes": "LLM data flows threat-modelled — all injection paths identified and documented", + "notes": "LLM data flows threat-modelled — all injection paths identified and documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent abuse of LLM functions", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -1725,51 +1731,56 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data is not cached or exposed in logs", + "control_id": "V14.2.2", + "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.", "tier": "Foundational", "scope": "Both", "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", - "control_name": "Verify PII is identified and protected", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Foundational", "scope": "Both", "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control decisions enforce least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify all sensitive data encrypted at rest", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Foundational", "scope": "Both", "notes": "Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", - "control_name": "Verify all sensitive data encrypted in transit", + "control_id": "V12.2.1", + "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.", "tier": "Foundational", "scope": "Both", "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -2901,41 +2912,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "LLM tool access enforced at minimum required scope — read-only by default", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", - "control_name": "Verify all sensitive functions have access control", + "control_id": "V8.3.1", + "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.", "tier": "Foundational", "scope": "Both", "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", - "control_name": "Verify all business logic decisions logged", + "control_id": "V16.3.2", + "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", "tier": "Foundational", "scope": "Both", "notes": "All LLM tool invocations logged with full context — every tool call auditable", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic abuse scenarios identified", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Business logic controls preventing tool misuse through prompt manipulation", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -4175,7 +4190,8 @@ window.CROSSWALK_DATA = [ "control_name": "Verify third-party components are current and free from vulnerabilities", "tier": "Foundational", "scope": "Both", - "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained", + "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -4185,17 +4201,19 @@ window.CROSSWALK_DATA = [ "control_name": "Verify only minimal approved external libraries are used", "tier": "Foundational", "scope": "Both", - "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected", + "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.2", - "control_name": "Verify build pipelines include security checks", + "control_id": "V13.4.5", + "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.", "tier": "Foundational", "scope": "Both", "notes": "CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -5378,11 +5396,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all inputs validated against allowlist", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "tier": "Hardening", "scope": "Both", "notes": "Training data pipeline input validation — anomalous data rejected before training", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -5392,17 +5411,19 @@ window.CROSSWALK_DATA = [ "control_name": "Verify third-party components free of vulnerabilities", "tier": "Hardening", "scope": "Both", - "notes": "Training pipeline components scanned — compromised dependencies rejected", + "notes": "Training pipeline components scanned — compromised dependencies rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", - "control_name": "Verify file uploads scanned for malware", + "control_id": "V5.2.1", + "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", "tier": "Hardening", "scope": "Both", "notes": "Training data uploads scanned before ingestion — adversarial content detected", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -6522,41 +6543,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting on all LLM API endpoints — per user, per session, per API key", + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.3", - "control_name": "Verify API rejects large unexpected payloads", + "control_id": "V14.2.1", + "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.", "tier": "Foundational", "scope": "Both", "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.4", - "control_name": "Verify business logic rate limits", + "control_id": "V2.4.1", + "control_name": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.", "tier": "Foundational", "scope": "Both", "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify error handling does not expose sensitive data", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", "tier": "Foundational", "scope": "Both", "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -7595,31 +7620,34 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.1", - "control_name": "Verify business logic assumptions documented", + "control_id": "V2.3.1", + "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "tier": "Foundational", "scope": "Both", "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify all security controls logged", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", "tier": "Foundational", "scope": "Both", "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify outputs encoded before rendering", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -8776,41 +8804,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", - "control_name": "Verify sensitive data not cached in cleartext", + "control_id": "V14.2.2", + "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.", "tier": "Foundational", "scope": "Both", "notes": "System prompts not stored in cleartext application configuration or source code", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "System prompt access restricted to authorised personnel — read access logged", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify access control decisions logged", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "tier": "Foundational", "scope": "Both", "notes": "All access to system prompts logged — unauthorised access attempts detectable", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.3", - "control_name": "Verify secrets not in source code", + "control_id": "V3.6.1", + "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.", "tier": "Foundational", "scope": "Both", "notes": "System prompts not hardcoded in source code — stored in secret management system", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -9837,31 +9869,34 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify least privilege access control on data", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Hardening", "scope": "Both", "notes": "RBAC on all vector store collections — no unauthenticated access", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify all sensitive data encrypted at rest", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Hardening", "scope": "Both", "notes": "All vector store content encrypted at rest", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", - "control_name": "Verify file upload malware scanning", + "control_id": "V5.2.1", + "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", "tier": "Hardening", "scope": "Both", "notes": "Content validation on all vector store ingestion — adversarial content detected", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -10912,51 +10947,56 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding of untrusted data in HTML context", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "LLM responses rendered in browser contexts encoded against XSS", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.5", - "control_name": "Verify output encoding in SQL query context", + "control_id": "V1.2.4", + "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify output encoding in OS command context", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "tier": "Foundational", "scope": "Both", "notes": "LLM-generated commands validated — never raw output in shell context", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.4", - "control_name": "Verify application does not use eval or dynamic code", + "control_id": "V1.3.2", + "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.", "tier": "Foundational", "scope": "Both", "notes": "No eval or dynamic code execution of LLM-generated content", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.2.2", - "control_name": "Verify anti-CSRF tokens in state-changing operations", + "control_id": "V3.5.1", + "control_name": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).", "tier": "Foundational", "scope": "Both", "notes": "CSRF protection on endpoints where LLM output triggers state changes", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -13148,31 +13188,34 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all user input validated against allowlist", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "tier": "Foundational", "scope": "Both", "notes": "All inputs to agents validated — indirect injection through processed content equally in scope", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding prevents injection", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify application protects against OS command injection", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "tier": "Foundational", "scope": "Both", "notes": "Agent-generated instructions not executed in system context without validation", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -13182,17 +13225,19 @@ window.CROSSWALK_DATA = [ "control_name": "Threat modelling of all data flows", "tier": "Foundational", "scope": "Both", - "notes": "All agent input sources threat-modelled — every indirect injection path documented", + "notes": "All agent input sources threat-modelled — every indirect injection path documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent function abuse", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Business logic controls prevent injection from redirecting agent goal", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -14506,51 +14551,56 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", - "control_name": "Verify all sensitive functions have access control", + "control_id": "V8.3.1", + "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.", "tier": "Foundational", "scope": "Both", "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", - "control_name": "Verify all business logic decisions logged", + "control_id": "V16.3.2", + "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", "tier": "Foundational", "scope": "Both", "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic abuse scenarios identified", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "tier": "Foundational", "scope": "Both", - "notes": "Tool API endpoints rate-limited — anomalous invocation frequency detected", + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -15786,51 +15836,56 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", - "control_name": "Verify credentials not in source code", + "control_id": "V6.2.1", + "control_name": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials not hardcoded — secret manager required", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Foundational", "scope": "Both", "notes": "Agent credential scope minimum required — no over-privileged NHIs", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify sensitive data encrypted at rest", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify access control decisions logged", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "tier": "Foundational", "scope": "Both", "notes": "All credential usage logged — issuance, access, expiry detectable", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.3", - "control_name": "Verify secrets not in source code", + "control_id": "V3.6.1", + "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.", "tier": "Foundational", "scope": "Both", "notes": "Agent credentials not committed to source control", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -17145,7 +17200,8 @@ window.CROSSWALK_DATA = [ "control_name": "Verify third-party components current and free of vulnerabilities", "tier": "Foundational", "scope": "Both", - "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored", + "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -17155,17 +17211,19 @@ window.CROSSWALK_DATA = [ "control_name": "Verify only minimal approved external libraries", "tier": "Foundational", "scope": "Both", - "notes": "Approved component list — unsigned or unverified agent components rejected", + "notes": "Approved component list — unsigned or unverified agent components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V14.2.2", - "control_name": "Verify build pipelines include security checks", + "control_id": "V13.4.5", + "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.", "tier": "Foundational", "scope": "Both", "notes": "CI/CD pipeline for agent components includes integrity verification and CVE scanning", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -17175,7 +17233,8 @@ window.CROSSWALK_DATA = [ "control_name": "Verify threat model covers all data flows", "tier": "Foundational", "scope": "Both", - "notes": "Supply chain threat model documents all agent component sources and trust levels", + "notes": "Supply chain threat model documents all agent component sources and trust levels — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -18328,51 +18387,56 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify output encoding of untrusted data in HTML context", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Hardening", "scope": "Both", "notes": "Agent code output encoded before rendering in any context", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.4", - "control_name": "Verify application does not use eval or dynamic code", + "control_id": "V1.3.2", + "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.", "tier": "Hardening", "scope": "Both", "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", - "control_name": "Verify output encoding in OS command context", + "control_id": "V1.3.7", + "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", "tier": "Hardening", "scope": "Both", "notes": "Agent-generated commands validated before any shell execution", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.5", - "control_name": "Verify output encoding in SQL context", + "control_id": "V1.2.4", + "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.", "tier": "Hardening", "scope": "Both", "notes": "No raw agent output in SQL context — parameterised execution only", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Hardening", "scope": "Both", "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -19526,41 +19590,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", - "control_name": "Verify all user input validated against allowlist", + "control_id": "V15.3.7", + "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "tier": "Hardening", "scope": "Both", "notes": "All content entering agent memory validated — injection patterns rejected at write boundary", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces least privilege", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Hardening", "scope": "Both", "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", - "control_name": "Verify sensitive data encrypted at rest", + "control_id": "V14.1.1", + "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", "tier": "Hardening", "scope": "Both", "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", - "control_name": "Verify file upload malware scanning", + "control_id": "V5.2.1", + "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", "tier": "Hardening", "scope": "Both", "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -20703,41 +20771,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", - "control_name": "Verify TLS used for all client connectivity", + "control_id": "V12.2.1", + "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.", "tier": "Hardening", "scope": "Both", "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.3.1", - "control_name": "Verify anti-replay tokens in state-changing operations", + "control_id": "V7.4.1", + "control_name": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.", "tier": "Hardening", "scope": "Both", "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", - "control_name": "Verify access control enforces identity", + "control_id": "V8.2.1", + "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "tier": "Hardening", "scope": "Both", "notes": "A2A channels enforce sender identity — unauthenticated messages rejected", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify all security controls logged", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "tier": "Hardening", "scope": "Both", "notes": "All A2A messages logged — sender identity, content hash, schema validation results", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -21834,41 +21906,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.1", - "control_name": "Verify business logic assumptions documented", + "control_id": "V2.3.1", + "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "tier": "Foundational", "scope": "Both", "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent abuse", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Foundational", "scope": "Both", "notes": "Circuit breakers as business logic controls — cascade propagation limited by design", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "tier": "Foundational", "scope": "Both", - "notes": "Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited", + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify error handling does not expose sensitive data", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", "tier": "Foundational", "scope": "Both", "notes": "Cascade errors handled gracefully — no sensitive system information in error responses", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -22964,41 +23040,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.1", - "control_name": "Verify business logic assumptions documented", + "control_id": "V2.3.1", + "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "tier": "Foundational", "scope": "Both", "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", - "control_name": "Verify outputs encoded before rendering", + "control_id": "V1.3.1", + "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", "tier": "Foundational", "scope": "Both", "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", - "control_name": "Verify all security controls logged", + "control_id": "V16.5.1", + "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", "tier": "Foundational", "scope": "Both", "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.3", - "control_name": "Verify API rejects large unexpected payloads", + "control_id": "V14.2.1", + "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.", "tier": "Foundational", "scope": "Both", "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -24123,41 +24203,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.1", - "control_name": "Verify access control decisions logged", + "control_id": "V16.3.1", + "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", "tier": "Hardening", "scope": "Both", "notes": "All agent actions logged — no production deployment without complete observability", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", - "control_name": "Verify all business logic decisions logged", + "control_id": "V16.3.2", + "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", "tier": "Hardening", "scope": "Both", "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.2", - "control_name": "Verify business logic limits prevent abuse", + "control_id": "V2.4.2", + "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", "tier": "Hardening", "scope": "Both", "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "Verify API rate limiting", "tier": "Hardening", "scope": "Both", - "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion", + "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -25352,51 +25436,56 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", + "control_id": "V14.2.2", "control_name": "Sensitive data not transmitted in URL parameters", "tier": "Foundational", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", + "control_id": "V14.1.1", "control_name": "Sensitive data identified and classified", "tier": "Foundational", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", + "control_id": "V8.2.1", "control_name": "Deny by default access control", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.8", + "control_id": "V1.3.5", "control_name": "Output encoding for context", "tier": "Foundational", "scope": "Both", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", + "control_id": "V14.1.1", "control_name": "Sensitive data not stored in cleartext", "tier": "Foundational", "scope": "Both", "parent": "V6", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -26559,41 +26648,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", + "control_id": "V6.2.1", "control_name": "Passwords minimum 12 characters", "tier": "Foundational", "scope": "Both", "parent": "V2", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.10.1", + "control_id": "V13.2.1", "control_name": "Integration secrets not hardcoded", "tier": "Foundational", "scope": "Both", "parent": "V2", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.2", + "control_id": "V8.2.1", "control_name": "Least privilege for service accounts", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.7", + "control_id": "V14.1.2", "control_name": "Data transferred using current TLS", "tier": "Foundational", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -27634,26 +27727,30 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "parent": "V1", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.5", + "control_id": "V16.5.3", "control_name": "Access control failures logged", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", + "control_id": "V16.3.2", "control_name": "Log entries contain required information", "tier": "Foundational", "scope": "Both", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -27664,6 +27761,8 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "parent": "V14", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -28612,11 +28711,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.3", + "control_id": "V2.2.1", "control_name": "Input validation server-side", "tier": "Hardening", "scope": "Both", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -28627,6 +28727,8 @@ window.CROSSWALK_DATA = [ "tier": "Hardening", "scope": "Both", "parent": "V10", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -28637,16 +28739,19 @@ window.CROSSWALK_DATA = [ "tier": "Hardening", "scope": "Both", "parent": "V10", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", + "control_id": "V5.2.1", "control_name": "File upload size limits", "tier": "Hardening", "scope": "Both", "parent": "V12", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -29699,31 +29804,34 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", + "control_id": "V15.3.7", "control_name": "Input validation using allowlists", "tier": "Foundational", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.1", + "control_id": "V1.3.1", "control_name": "HTML/JS output sanitised", "tier": "Foundational", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.4.1", + "control_id": "V16.5.1", "control_name": "Generic error messages", "tier": "Foundational", "scope": "Build", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -30754,31 +30862,34 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control on every request", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V9.1.1", + "control_id": "V12.2.1", "control_name": "TLS for all connections", "tier": "Foundational", "scope": "Both", "parent": "V9", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.4", + "control_id": "V2.4.1", "control_name": "Business logic limits on repeated actions", "tier": "Foundational", "scope": "Both", "parent": "V11", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -31750,26 +31861,30 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", + "control_id": "V14.1.1", "control_name": "Sensitive data identified and classified", "tier": "Foundational", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.5", + "control_id": "V16.5.3", "control_name": "Attribute-based access control", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -32725,6 +32840,8 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -32735,16 +32852,19 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.2.2", + "control_id": "V16.3.2", "control_name": "Audit trail sufficient for compliance", "tier": "Foundational", "scope": "Both", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -33802,11 +33922,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.5", + "control_id": "V1.3.7", "control_name": "Unstructured data sanitised", "tier": "Hardening", "scope": "Both", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -33817,16 +33938,19 @@ window.CROSSWALK_DATA = [ "tier": "Hardening", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.3", + "control_id": "V5.2.4", "control_name": "Malicious file detection on upload", "tier": "Hardening", "scope": "Both", "parent": "V12", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -34770,21 +34894,23 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", + "control_id": "V14.1.1", "control_name": "Sensitive data classified", "tier": "Hardening", "scope": "Build", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.2.6", + "control_id": "V1.3.6", "control_name": "Defined output structure", "tier": "Hardening", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -35691,31 +35817,34 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.1.1", + "control_id": "V14.2.1", "control_name": "Session tokens unique and random", "tier": "Foundational", "scope": "Build", "parent": "V3", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.3.1", + "control_id": "V7.4.1", "control_name": "Sessions invalidated after logout", "tier": "Foundational", "scope": "Build", "parent": "V3", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control enforced on every request", "tier": "Foundational", "scope": "Build", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -35726,6 +35855,8 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "parent": "V8", + "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, INSUFFICIENT IMPACT; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -36670,41 +36801,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.1", + "control_id": "V15.3.7", "control_name": "Allowlist input validation", "tier": "Foundational", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.3.4", + "control_id": "V1.2.4", "control_name": "SQL injection prevention", "tier": "Foundational", "scope": "Build", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control on every request", "tier": "Foundational", "scope": "Build", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V13.1.1", + "control_id": "V1.5.3", "control_name": "API protection against enumeration", "tier": "Foundational", "scope": "Build", "parent": "V13", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -37671,31 +37806,34 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", + "control_id": "V8.2.1", "control_name": "Deny by default", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", + "control_id": "V14.1.1", "control_name": "Sensitive data not stored in cleartext", "tier": "Foundational", "scope": "Both", "parent": "V6", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V12.1.1", + "control_id": "V5.2.1", "control_name": "File upload validation", "tier": "Foundational", "scope": "Both", "parent": "V12", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -38687,41 +38825,45 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.1.1", + "control_id": "V16.2.5", "control_name": "No credential logging", "tier": "Foundational", "scope": "Build", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V7.1.2", + "control_id": "V16.2.5", "control_name": "No sensitive data in logs", "tier": "Foundational", "scope": "Build", "parent": "V7", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.1.1", + "control_id": "V14.2.2", "control_name": "Sensitive data not in URLs", "tier": "Foundational", "scope": "Build", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control on log stores", "tier": "Foundational", "scope": "Build", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -39707,11 +39849,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.3", + "control_id": "V8.2.1", "control_name": "Deny by default access control", "tier": "Foundational", "scope": "Build", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -39722,16 +39865,19 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "parent": "V8", + "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V3.1.1", + "control_id": "V14.2.1", "control_name": "Session isolation", "tier": "Foundational", "scope": "Build", "parent": "V3", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -40672,21 +40818,23 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.2", + "control_id": "V8.2.1", "control_name": "Least privilege", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.5", + "control_id": "V2.2.1", "control_name": "Business logic prevents excess data access", "tier": "Foundational", "scope": "Both", "parent": "V11", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -40697,6 +40845,8 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "parent": "V1", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -41686,6 +41836,8 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "parent": "V11", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -41696,6 +41848,8 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "parent": "V13", + "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -42709,21 +42863,23 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V8.3.4", + "control_id": "V14.1.1", "control_name": "Sensitive data identified", "tier": "Hardening", "scope": "Both", "parent": "V8", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V6.1.1", + "control_id": "V14.1.1", "control_name": "Sensitive data not stored in cleartext", "tier": "Hardening", "scope": "Both", "parent": "V6", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -43612,11 +43768,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.2", + "control_id": "V8.2.1", "control_name": "Least privilege", "tier": "Foundational", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -43627,16 +43784,19 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V2.1.1", + "control_id": "V6.2.1", "control_name": "Strong authentication", "tier": "Foundational", "scope": "Both", "parent": "V2", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -44572,11 +44732,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V4.1.1", + "control_id": "V8.3.1", "control_name": "Access control per request", "tier": "Hardening", "scope": "Both", "parent": "V4", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, @@ -44587,6 +44748,8 @@ window.CROSSWALK_DATA = [ "tier": "Hardening", "scope": "Both", "parent": "V8", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -44597,6 +44760,8 @@ window.CROSSWALK_DATA = [ "tier": "Hardening", "scope": "Both", "parent": "V10", + "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**", + "framework_version": "ASVS 4.0.3", "confidence": "unreviewed", "reviewed_by": [] }, @@ -45576,21 +45741,23 @@ window.CROSSWALK_DATA = [ }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V5.1.3", + "control_id": "V2.2.1", "control_name": "Server-side input validation", "tier": "Hardening", "scope": "Both", "parent": "V5", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "OWASP ASVS 4.0.3", - "control_id": "V11.1.4", + "control_id": "V2.4.1", "control_name": "Enforce business logic limits", "tier": "Hardening", "scope": "Both", "parent": "V11", + "framework_version": "ASVS 5.0.0", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/docs/frameworks-registry.js b/docs/frameworks-registry.js index b0c26b5..bd6dfd4 100644 --- a/docs/frameworks-registry.js +++ b/docs/frameworks-registry.js @@ -7734,585 +7734,647 @@ window.CROSSWALK_FRAMEWORKS = [ "id": "owasp-asvs", "name": "OWASP ASVS 4.0.3", "short_name": "ASVS", - "version": "4.0.3", + "version": "5.0.0", "url": "https://owasp.org/projects/asvs", "license": "CC BY-SA 4.0", "publisher": "OWASP", "category": "appsec", - "last_synced": "2026-04-10", + "last_synced": "2026-09-18", "source_sha": null, "controls": [ { "control_id": "V1", - "title": "Architecture, Design and Threat Modeling", - "description": "Ensure a verified application satisfies high-level security architecture requirements.", + "title": "Encoding and Sanitization", + "description": "", "parent": null, - "function": "Architecture", - "kind": "control" - }, - { - "control_id": "V1.1", - "title": "Secure Software Development Lifecycle", - "description": "Ensure the use of a secure software development lifecycle that addresses security in all stages.", - "parent": "V1", - "function": "Architecture", + "function": "Encoding and Sanitization", "kind": "control" }, { "control_id": "V1.1.2", "title": "Threat modelling of all data flows", "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented", - "kind": "control" + "parent": null, + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { "control_id": "V1.1.4", "title": "Trust boundaries documented and enforced", + "description": "", + "parent": "V1", + "function": null, "kind": "control", - "parent": "V1" + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { "control_id": "V1.2", - "title": "Authentication Architecture", - "description": "Verify that authentication is addressed in the architecture.", + "title": "Injection Prevention", + "description": "", "parent": "V1", - "function": "Architecture", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V1.4", - "title": "Access Control Architecture", - "description": "Verify that access controls are applied consistently.", - "parent": "V1", - "function": "Architecture", + "control_id": "V1.2.4", + "title": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.", + "description": "", + "parent": "V1.2", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V1.5", - "title": "Input and Output Architecture", - "description": "Verify that input and output requirements define handling of data based on type and content.", + "control_id": "V1.3", + "title": "Sanitization", + "description": "", "parent": "V1", - "function": "Architecture", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2", - "title": "Authentication", - "description": "Verify that the application uses appropriate authentication mechanisms.", - "parent": null, - "function": "Verification", + "control_id": "V1.3.1", + "title": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.1", - "title": "Password Security", - "description": "Verify password requirements align with modern standards.", - "parent": "V2", - "function": "Verification", + "control_id": "V1.3.2", + "title": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.1.1", - "title": "Verify credentials not in source code", - "description": "Agent credentials not hardcoded — secret manager required", + "control_id": "V1.3.5", + "title": "Verify that the application sanitizes or disables user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode, or similar.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.5", - "title": "Credential Recovery", - "description": "Verify credential recovery mechanisms are secure.", - "parent": "V2", - "function": "Verification", + "control_id": "V1.3.6", + "title": "Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by validating untrusted data against an allowlist of protocols, domains, paths and ports and sanitizing potentially dangerous characters before using the data to call another service.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.8", - "title": "One Time Verifier", - "description": "Verify one-time passwords and verifiers are secure.", - "parent": "V2", - "function": "Verification", + "control_id": "V1.3.7", + "title": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.", + "description": "", + "parent": "V1.3", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V2.10.1", - "title": "Integration secrets not hardcoded", + "control_id": "V1.5", + "title": "Safe Deserialization", "description": "", - "parent": "V2", + "parent": "V1", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V3", - "title": "Session Management", - "description": "Verify the application has adequate session management controls.", - "parent": null, - "function": "Verification", + "control_id": "V1.5.3", + "title": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks.", + "description": "", + "parent": "V1.5", + "function": "Encoding and Sanitization", "kind": "control" }, { - "control_id": "V3.1.1", - "title": "Session tokens unique and random", - "kind": "control", - "parent": "V3" - }, - { - "control_id": "V3.3.1", - "title": "Verify anti-replay tokens in state-changing operations", - "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers", + "control_id": "V2", + "title": "Validation and Business Logic", + "description": "", + "parent": null, + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4", - "title": "Access Control", - "description": "Verify that users can only access functions and data for which they possess specific authorization.", - "parent": null, - "function": "Verification", + "control_id": "V2.2", + "title": "Input Validation", + "description": "", + "parent": "V2", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1", - "title": "General Access Control Design", - "description": "Verify access control is applied server-side and consistently.", - "parent": "V4", - "function": "Verification", + "control_id": "V2.2.1", + "title": "Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input.", + "description": "", + "parent": "V2.2", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1.1", - "title": "Verify all sensitive functions have access control", - "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation", + "control_id": "V2.3", + "title": "Business Logic Security", + "description": "", + "parent": "V2", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1.2", - "title": "Least privilege for service accounts", + "control_id": "V2.3.1", + "title": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.", "description": "", - "parent": "V4", + "parent": "V2.3", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1.3", - "title": "Verify access control enforces least privilege", - "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write", + "control_id": "V2.4", + "title": "Anti-automation", + "description": "", + "parent": "V2", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.1.5", - "title": "Access control failures logged", + "control_id": "V2.4.1", + "title": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.", "description": "", - "parent": "V4", + "parent": "V2.4", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.2", - "title": "Operation Level Access Control", - "description": "Verify access controls at the operation and function level.", - "parent": "V4", - "function": "Verification", + "control_id": "V2.4.2", + "title": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.", + "description": "", + "parent": "V2.4", + "function": "Validation and Business Logic", "kind": "control" }, { - "control_id": "V4.2.2", - "title": "Verify anti-CSRF tokens in state-changing operations", - "description": "CSRF protection on endpoints where LLM output triggers state changes", + "control_id": "V3", + "title": "Web Frontend Security", + "description": "", + "parent": null, + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5", - "title": "Validation, Sanitization and Encoding", - "description": "Verify that the application sanitizes, validates, and encodes untrusted input.", - "parent": null, - "function": "Verification", + "control_id": "V3.5", + "title": "Browser Origin Separation", + "description": "", + "parent": "V3", + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5.1", - "title": "Input Validation", - "description": "Verify input validation controls are in place.", - "parent": "V5", - "function": "Verification", + "control_id": "V3.5.1", + "title": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).", + "description": "", + "parent": "V3.5", + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5.1.1", - "title": "Verify all user input validated against allowlist", - "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope", + "control_id": "V3.6", + "title": "External Resource Integrity", + "description": "", + "parent": "V3", + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5.1.2", - "title": "Verify that HTTP request parts are validated, sanitised, or rejected", - "description": "LLM API request validation — prompt structure, content type, and character set enforced", + "control_id": "V3.6.1", + "title": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.", + "description": "", + "parent": "V3.6", + "function": "Web Frontend Security", "kind": "control" }, { - "control_id": "V5.1.3", - "title": "Input validation server-side", + "control_id": "V5", + "title": "File Handling", "description": "", - "parent": "V5", + "parent": null, + "function": "File Handling", "kind": "control" }, { "control_id": "V5.2", - "title": "Sanitization and Sandboxing", - "description": "Verify that sanitization and sandboxing are used to prevent injection.", + "title": "File Upload and Content", + "description": "", "parent": "V5", - "function": "Verification", + "function": "File Handling", "kind": "control" }, { "control_id": "V5.2.1", - "title": "Verify output encoding prevents injection", - "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content", + "title": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.", + "description": "", + "parent": "V5.2", + "function": "File Handling", "kind": "control" }, { "control_id": "V5.2.4", - "title": "Verify application does not use eval or dynamic code", - "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content", + "title": "Verify that a file size quota and maximum number of files per user are enforced to ensure that a single user cannot fill up the storage with too many files, or excessively large files.", + "description": "", + "parent": "V5.2", + "function": "File Handling", "kind": "control" }, { - "control_id": "V5.2.5", - "title": "Verify application protects against OS command injection", - "description": "Agent-generated instructions not executed in system context without validation; Agent-generated commands validated before any shell execution; LLM-generated content validated before execution in any shell or interpreter context", + "control_id": "V6", + "title": "Authentication", + "description": "", + "parent": null, + "function": "Authentication", "kind": "control" }, { - "control_id": "V5.2.6", - "title": "Defined output structure", + "control_id": "V6.2", + "title": "Password Security", "description": "", - "parent": "V5", + "parent": "V6", + "function": "Authentication", "kind": "control" }, { - "control_id": "V5.2.8", - "title": "Output encoding for context", - "kind": "control", - "parent": "V5" - }, - { - "control_id": "V5.3", - "title": "Output Encoding and Injection Prevention", - "description": "Verify that output encoding prevents injection attacks.", - "parent": "V5", - "function": "Verification", + "control_id": "V6.2.1", + "title": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.", + "description": "", + "parent": "V6.2", + "function": "Authentication", "kind": "control" }, { - "control_id": "V5.3.4", - "title": "SQL injection prevention", + "control_id": "V7", + "title": "Session Management", "description": "", - "parent": "V5", + "parent": null, + "function": "Session Management", "kind": "control" }, { - "control_id": "V5.3.5", - "title": "Verify output encoding in SQL context", - "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context", + "control_id": "V7.4", + "title": "Session Termination", + "description": "", + "parent": "V7", + "function": "Session Management", "kind": "control" }, { - "control_id": "V5.5", - "title": "Deserialization Prevention", - "description": "Verify that deserialization is done safely.", - "parent": "V5", - "function": "Verification", + "control_id": "V7.4.1", + "title": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.", + "description": "", + "parent": "V7.4", + "function": "Session Management", "kind": "control" }, { - "control_id": "V6", - "title": "Stored Cryptography", - "description": "Verify that cryptographic modules and algorithms are used correctly.", + "control_id": "V8", + "title": "Authorization", + "description": "", "parent": null, - "function": "Verification", - "kind": "control" - }, - { - "control_id": "V6.1.1", - "title": "Verify sensitive data encrypted at rest", - "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest", + "function": "Authorization", "kind": "control" }, { - "control_id": "V7", - "title": "Error Handling and Logging", - "description": "Verify that errors are handled safely and logs contain sufficient information.", - "parent": null, - "function": "Verification", - "kind": "control" + "control_id": "V8.1.3", + "title": "Sensitive data not in session storage", + "description": "", + "parent": "V8", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, INSUFFICIENT IMPACT)" }, { - "control_id": "V7.1", - "title": "Log Content", - "description": "Verify that security-relevant events are logged.", - "parent": "V7", - "function": "Verification", - "kind": "control" + "control_id": "V8.1.4", + "title": "Sensitive data minimisation", + "description": "", + "parent": "V8", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { - "control_id": "V7.1.1", - "title": "No credential logging", + "control_id": "V8.2", + "title": "General Authorization Design", "description": "", - "parent": "V7", + "parent": "V8", + "function": "Authorization", "kind": "control" }, { - "control_id": "V7.1.2", - "title": "No sensitive data in logs", + "control_id": "V8.2.1", + "title": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.", "description": "", - "parent": "V7", + "parent": "V8.2", + "function": "Authorization", "kind": "control" }, { - "control_id": "V7.2", - "title": "Log Processing", - "description": "Verify that logs are processed securely.", - "parent": "V7", - "function": "Verification", + "control_id": "V8.3", + "title": "Operation Level Authorization", + "description": "", + "parent": "V8", + "function": "Authorization", "kind": "control" }, { - "control_id": "V7.2.1", - "title": "Verify access control decisions logged", - "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability", + "control_id": "V8.3.1", + "title": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.", + "description": "", + "parent": "V8.3", + "function": "Authorization", "kind": "control" }, { - "control_id": "V7.2.2", - "title": "Verify all business logic decisions logged", - "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable", - "kind": "control" + "control_id": "V8.3.3", + "title": "Consent obtained before PI processing", + "description": "", + "parent": "V8", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { - "control_id": "V7.4.1", - "title": "Verify error handling does not expose sensitive data", - "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality", - "kind": "control" + "control_id": "V8.3.10", + "title": "Personal data not kept longer than needed", + "description": "", + "parent": "V8", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 ((id absent from the official 4.0.3 mapping))" }, { - "control_id": "V8", - "title": "Data Protection", - "description": "Verify that data is protected in transit and at rest.", + "control_id": "V10.2.1", + "title": "Verify third-party components current and free of vulnerabilities", + "description": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained; Training pipeline components scanned — compromised dependencies rejected", "parent": null, - "function": "Verification", - "kind": "control" + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT PRACTICAL)" }, { - "control_id": "V8.1", - "title": "General Data Protection", - "description": "Verify sensitive data is identified and protected.", - "parent": "V8", - "function": "Verification", - "kind": "control" + "control_id": "V10.2.2", + "title": "Verify only minimal approved external libraries", + "description": "Approved component list — unsigned or unverified agent components rejected; Approved component list for LLM deployments — unsigned or unverified components rejected", + "parent": null, + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT PRACTICAL)" }, { - "control_id": "V8.1.1", - "title": "Verify sensitive data is not cached or exposed in logs", - "description": "LLM outputs containing sensitive data not logged in cleartext or cached without protection; System prompts not stored in cleartext application configuration or source code", - "kind": "control" + "control_id": "V11.1.7", + "title": "Anti-automation controls", + "description": "", + "parent": "V11", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { - "control_id": "V8.1.3", - "title": "Sensitive data not in session storage", + "control_id": "V12", + "title": "Secure Communication", "description": "", - "parent": "V8", + "parent": null, + "function": "Secure Communication", "kind": "control" }, { - "control_id": "V8.1.4", - "title": "Sensitive data minimisation", + "control_id": "V12.2", + "title": "HTTPS Communication with External Facing Services", "description": "", - "parent": "V8", + "parent": "V12", + "function": "Secure Communication", "kind": "control" }, { - "control_id": "V8.3", - "title": "Sensitive Private Data", - "description": "Verify that sensitive data is protected from unauthorized access.", - "parent": "V8", - "function": "Verification", + "control_id": "V12.2.1", + "title": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.", + "description": "", + "parent": "V12.2", + "function": "Secure Communication", "kind": "control" }, { - "control_id": "V8.3.3", - "title": "Consent obtained before PI processing", + "control_id": "V13", + "title": "Configuration", "description": "", - "parent": "V8", + "parent": null, + "function": "Configuration", "kind": "control" }, { - "control_id": "V8.3.4", - "title": "Verify PII is identified and protected", - "description": "PII in LLM training data, RAG sources, and outputs identified and handled per policy", - "kind": "control" + "control_id": "V13.1.2", + "title": "API throttling", + "description": "", + "parent": "V13", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 ((id absent from the official 4.0.3 mapping))" }, { - "control_id": "V8.3.7", - "title": "Data transferred using current TLS", + "control_id": "V13.2", + "title": "Backend Communication Configuration", "description": "", - "parent": "V8", + "parent": "V13", + "function": "Configuration", "kind": "control" }, { - "control_id": "V8.3.10", - "title": "Personal data not kept longer than needed", + "control_id": "V13.2.1", + "title": "Verify that communications between backend application components that don't support the application's standard user session mechanism, including APIs, middleware, and data layers, are authenticated. Authentication must use individual service accounts, short-term tokens, or certificate-based authentication and not unchanging credentials such as passwords, API keys, or shared accounts with privileged access.", "description": "", - "parent": "V8", + "parent": "V13.2", + "function": "Configuration", "kind": "control" }, { - "control_id": "V9", - "title": "Communication", - "description": "Verify that communications are encrypted using TLS.", - "parent": null, - "function": "Verification", + "control_id": "V13.4", + "title": "Unintended Information Leakage", + "description": "", + "parent": "V13", + "function": "Configuration", "kind": "control" }, { - "control_id": "V9.1.1", - "title": "Verify TLS used for all client connectivity", - "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum", + "control_id": "V13.4.5", + "title": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.", + "description": "", + "parent": "V13.4", + "function": "Configuration", "kind": "control" }, { - "control_id": "V10", - "title": "Malicious Code", - "description": "Verify that code does not contain malicious logic.", + "control_id": "V14", + "title": "Data Protection", + "description": "", "parent": null, - "function": "Verification", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V10.2.1", - "title": "Verify third-party components current and free of vulnerabilities", - "description": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained; Training pipeline components scanned — compromised dependencies rejected", + "control_id": "V14.1", + "title": "Data Protection Documentation", + "description": "", + "parent": "V14", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V10.2.2", - "title": "Verify only minimal approved external libraries", - "description": "Approved component list — unsigned or unverified agent components rejected; Approved component list for LLM deployments — unsigned or unverified components rejected", + "control_id": "V14.1.1", + "title": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.", + "description": "", + "parent": "V14.1", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11", - "title": "Business Logic", - "description": "Verify that business logic flows are sequential and audited.", - "parent": null, - "function": "Verification", + "control_id": "V14.1.2", + "title": "Verify that all sensitive data protection levels have a documented set of protection requirements. This must include (but not be limited to) requirements related to general encryption, integrity verification, retention, how the data is to be logged, access controls around sensitive data in logs, database-level encryption, privacy and privacy-enhancing technologies to be used, and other confidentiality requirements.", + "description": "", + "parent": "V14.1", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11.1.1", - "title": "Verify business logic assumptions documented", - "description": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted; AI advisory limitations documented as business logic assumptions — verification requirements per domain; LLM accuracy limitations documented as business logic assumptions — verification requirements defined", - "kind": "control" + "control_id": "V14.1.4", + "title": "All components inventoried", + "description": "", + "parent": "V14", + "function": null, + "kind": "control", + "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)" }, { - "control_id": "V11.1.2", - "title": "Verify business logic limits prevent function abuse", - "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis", + "control_id": "V14.2", + "title": "General Data Protection", + "description": "", + "parent": "V14", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11.1.4", - "title": "Verify business logic rate limits", - "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies", + "control_id": "V14.2.1", + "title": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.", + "description": "", + "parent": "V14.2", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11.1.5", - "title": "Business logic prevents excess data access", + "control_id": "V14.2.2", + "title": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.", "description": "", - "parent": "V11", + "parent": "V14.2", + "function": "Data Protection", "kind": "control" }, { - "control_id": "V11.1.7", - "title": "Anti-automation controls", + "control_id": "V15", + "title": "Secure Coding and Architecture", "description": "", - "parent": "V11", + "parent": null, + "function": "Secure Coding and Architecture", "kind": "control" }, { - "control_id": "V12", - "title": "Files and Resources", - "description": "Verify that untrusted files and resources are handled safely.", - "parent": null, - "function": "Verification", + "control_id": "V15.3", + "title": "Defensive Coding", + "description": "", + "parent": "V15", + "function": "Secure Coding and Architecture", "kind": "control" }, { - "control_id": "V12.1.1", - "title": "Verify file upload malware scanning", - "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected", + "control_id": "V15.3.3", + "title": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.", + "description": "", + "parent": "V15.3", + "function": "Secure Coding and Architecture", "kind": "control" }, { - "control_id": "V12.1.3", - "title": "Malicious file detection on upload", + "control_id": "V15.3.7", + "title": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).", "description": "", - "parent": "V12", + "parent": "V15.3", + "function": "Secure Coding and Architecture", "kind": "control" }, { - "control_id": "V13", - "title": "API and Web Service", - "description": "Verify that API and web service requests are validated.", + "control_id": "V16", + "title": "Security Logging and Error Handling", + "description": "", "parent": null, - "function": "Verification", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V13.1", - "title": "Generic Web Service Security", - "description": "Verify that all API and web service interactions are authenticated and authorized.", - "parent": "V13", - "function": "Verification", + "control_id": "V16.2", + "title": "General Logging", + "description": "", + "parent": "V16", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V13.1.1", - "title": "Verify API rate limiting", - "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion", + "control_id": "V16.2.5", + "title": "Verify that when logging sensitive data, the application enforces logging based on the data's protection level. For example, it may not be allowed to log certain data, such as credentials or payment details. Other data, such as session tokens, may only be logged by being hashed or masked, either in full or partially.", + "description": "", + "parent": "V16.2", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V13.1.2", - "title": "API throttling", + "control_id": "V16.3", + "title": "Security Events", "description": "", - "parent": "V13", + "parent": "V16", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V13.1.3", - "title": "Verify API rejects large unexpected payloads", - "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway", + "control_id": "V16.3.1", + "title": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.", + "description": "", + "parent": "V16.3", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V14", - "title": "Configuration", - "description": "Verify that the application is securely configured.", - "parent": null, - "function": "Verification", + "control_id": "V16.3.2", + "title": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).", + "description": "", + "parent": "V16.3", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V14.1.4", - "title": "All components inventoried", - "kind": "control", - "parent": "V14" + "control_id": "V16.5", + "title": "Error Handling", + "description": "", + "parent": "V16", + "function": "Security Logging and Error Handling", + "kind": "control" }, { - "control_id": "V14.2.2", - "title": "Verify build pipelines include security checks", - "description": "CI/CD pipeline for agent components includes integrity verification and CVE scanning; CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning", + "control_id": "V16.5.1", + "title": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.", + "description": "", + "parent": "V16.5", + "function": "Security Logging and Error Handling", "kind": "control" }, { - "control_id": "V14.2.3", - "title": "Verify secrets not in source code", - "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system", + "control_id": "V16.5.3", + "title": "Verify that the application fails gracefully and securely, including when an exception occurs, preventing fail-open conditions such as processing a transaction despite errors resulting from validation logic.", + "description": "", + "parent": "V16.5", + "function": "Security Logging and Error Handling", "kind": "control" } ], @@ -8326,14 +8388,24 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Migrated off the swapped-column ids of issue #35: 75 items -> 82, including 17 referenced by mappings but absent from the registry", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Re-mapped to ASVS 5.0.0 using the project's own mapping_v4.0.3_to_v5.0.0.yml: 82 items -> 78, titles from the 5.0.0 release; 11 id(s) 5.0.0 deleted are kept and flagged (#22)", + "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Re-mapped to ASVS 5.0.0 using the project's own mapping_v4.0.3_to_v5.0.0.yml: 78 items -> 78, titles from the 5.0.0 release; 11 id(s) 5.0.0 deleted are kept and flagged (#22)", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { - "status": "unknown", - "included": 82, - "total": null, - "note": "Authoritative control count not established. Needs a count from the published framework.", - "source": "https://owasp.org/projects/asvs" + "status": "partial", + "included": 78, + "total": 345, + "note": "Holds the 44 requirement(s) the mappings cite plus their sections and chapters, titled from the ASVS 5.0.0 release. The standard has 345 requirements in total; the rest are not referenced by this crosswalk. 11 id(s) remain at 4.0.3 because 5.0.0 deleted them — see issue #22.", + "source": "https://github.com/OWASP/ASVS/releases/tag/v5.0.0_release" } }, {