--- title: "ASVS 5.0 mapping ยท Agent Wranglers" url: https://agentwranglers.se/playbook/application-security/asvs-5-0-mapping updated: 2026-10-27 build: a2a6bdfed830 tokens: 2381 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # ASVS 5.0 mapping For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Application security](https://agentwranglers.se/playbook/application-security.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. > Each rule in this playbook mapped to the OWASP Application Security Verification Standard 5.0 requirements it helps you meet, chapter by chapter. The Application Security Verification Standard (ASVS) 5.0.0 was released by OWASP in May 2025. It lists about 350 requirements in 17 chapters, each marked level 1, 2 or 3. The IDs below are ASVS chapter, section and requirement numbers, such as 1.2.4 for parameterised queries. Cite them in full as v5.0.0-1.2.4, since numbers changed from version 4. A rule with no ASVS ID covers a control that ASVS 5.0 leaves out, such as threat modelling, supply chain build integrity or AI features. Meeting a rule does not prove every word of the requirement. Check the requirement text itself, from the [OWASP ASVS project](https://owasp.org/www-project-application-security-verification-standard/). **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers application security playbook`. In code you write, add a comment next to it with the same link. ## Threat modelling | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-1 | Plan attacks before building | Not covered | | APS-93 | Draw the data flows and their trust boundaries | 13.1.1 | | APS-94 | Find threats at every boundary with STRIDE and LINDDUN | Not covered | | APS-95 | Write abuse cases next to user stories | Not covered | | APS-96 | Pick an ASVS level for each app | The whole standard | ## Input and injection | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-2 | Use parameterised queries | 1.2.4 | | APS-3 | Escape everything you show | 1.2.1, 1.2.2, 1.3.1, 3.2.2 | | APS-4 | Never pass input to a shell | 1.2.5 | | APS-5 | Keep input out of templates | 1.3.7 | | APS-6 | Strip line breaks from headers and logs | 16.4.1 | | APS-7 | Turn off external entities in XML | 1.5.1 | | APS-8 | Never rebuild objects from untrusted data | 1.5.2 | | APS-9 | Block prototype pollution | 15.3.6 | | APS-97 | Keep query operators out of document database input | 1.2.4 | | APS-98 | Escape input in directory queries | 1.2.6 | | APS-99 | Neutralise formulas in spreadsheet exports | 1.2.10 | ## Authentication and sessions | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-10 | Slow down password guessing | 6.3.1, 6.3.8 | | APS-11 | Store passwords with a slow hash | 11.4.2 | | APS-12 | Verify every token | 9.1.1, 9.1.2, 9.2.1, 9.2.3 | | APS-13 | Compare secrets in constant time | 11.2.4 | | APS-14 | Make tokens from a secure random source | 7.2.3, 11.5.1 | | APS-15 | Trust an email domain only after strict parsing | Not covered | | APS-16 | Lock down session cookies | 3.3.4, 7.2.4, 7.3.1, 7.3.2, 7.4.1 | | APS-17 | Set cookies safely or not at all | 3.3.1, 3.3.2, 3.3.3, 3.3.4 | | APS-18 | Block cross-site form posts | 3.5.1, 3.5.2, 3.5.3 | | APS-19 | Clear cached pages and data when someone signs out | 14.3.1 | ## Access control | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-20 | Deny by default and when a check fails | 8.3.1, 16.5.3 | | APS-21 | Accept only the fields you expect | 15.3.3 | | APS-22 | Return only the fields needed | 8.2.3, 14.2.6, 15.3.1 | | APS-101 | Decide access in one policy module | 8.1.1, 8.2.1, 8.2.2, 8.3.1 | ## Browser security headers | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-23 | Make browsers always use HTTPS | 3.4.1, 3.7.4 | | APS-24 | Load nothing over plain HTTP | 12.2.1 | | APS-25 | Allow only the scripts you wrote | 3.4.3 | | APS-26 | Collect reports of blocked content | 3.4.7 | | APS-27 | Stop browsers guessing file types | 3.4.4 | | APS-28 | Refuse to be framed | 3.4.6 | | APS-29 | Refuse odd requests from other sites | 3.5.8 | | APS-30 | Keep other sites' windows apart | 3.4.8, 3.5.8 | | APS-31 | Share less in the Referer header | 3.4.5 | | APS-32 | Switch off browser features you don't use | Not covered | | APS-33 | Lock scripts to a known hash | 3.6.1 | | APS-34 | Send a hash of the body | Not covered | | APS-35 | Lock down risky DOM writes | 3.2.2 | | APS-36 | Sending the old XSS filter header | Not covered | | APS-37 | Share data across sites on purpose | 3.4.2 | | APS-38 | Check the origin of WebSocket connections | 4.4.1, 4.4.2 | | APS-39 | Check the sender of every window message | 3.5.5 | | APS-40 | Redirect only to your own pages | 3.7.2 | | APS-100 | Send the security headers as one set | 3.4.1, 3.4.3, 3.4.4, 3.4.5, 3.4.8 | ## Requests, files and caches | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-41 | Fetch only allowed addresses | 1.3.6, 15.3.2 | | APS-42 | Treat data from other APIs as untrusted | 2.2.1 | | APS-43 | Check every uploaded file | 5.2.1, 5.2.2, 5.3.1, 5.4.1 | | APS-44 | Keep file paths inside their folder | 5.3.2 | | APS-45 | Unpack archives safely | 5.2.3, 5.2.5, 5.3.3 | | APS-46 | Keep private pages out of shared caches | 14.2.2, 14.2.5, 14.3.2 | | APS-47 | Keep unkeyed headers from changing cached pages | 14.2.5 | | APS-48 | Make every server agree where a request ends | 4.2.1, 4.2.2 | ## Limits and business logic | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-49 | Limit how often anyone can call your APIs | 2.4.1 | | APS-50 | Take the client address only from proxies you run | 4.1.3, 15.3.4 | | APS-51 | Keep regular expressions from stalling the server | 1.3.12 | | APS-52 | Work out every amount on the server | 2.2.2, 2.2.3, 2.3.1 | | APS-53 | Make each change happen exactly once | 2.3.3, 2.3.4, 15.4.2 | ## Cryptography and keys | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-54 | Encrypt data on the wire and on disk | 12.2.1, 12.3.1, 12.3.3 | | APS-55 | Turn off old encryption | 12.1.1, 12.1.2 | | APS-56 | Use only standard cryptography | 11.2.1, 11.3.1, 11.3.2, 11.4.1 | | APS-57 | Keep encryption keys in a key service | 11.1.1, 13.3.1, 13.3.3 | | APS-58 | Encrypt the most sensitive fields | 11.3.2, 11.3.3, 14.2.4 | | APS-59 | Prepare your encryption for quantum computers | 11.1.2, 11.1.4, 11.2.2 | | APS-102 | Renew certificates automatically | 12.2.2, 12.3.4 | | APS-103 | Wrap data keys with a key-encryption key | 11.1.1, 13.3.3 | ## Secrets and configuration | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-60 | Keep secrets out of code | 13.3.1 | | APS-61 | Keep secrets out of the browser | 13.3.1 | | APS-62 | Give each key the least power | 13.2.2, 13.3.2 | | APS-63 | Keep storage buckets private | 8.2.2 | | APS-64 | Close debug and admin doors | 13.4.2, 13.4.5 | | APS-65 | Serve no hidden files | 13.4.1, 13.4.3, 13.4.7 | | APS-66 | Remove defaults and samples | 6.3.2 | | APS-67 | Keep software current and quiet | 13.4.6, 15.2.1 | | APS-68 | Remove DNS records you no longer use | Not covered | ## Supply chain | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-69 | Lock and audit dependencies | 15.1.1, 15.2.1 | | APS-70 | Review every new package | 15.1.4, 15.2.4 | | APS-71 | Keep the dependency tree small | 15.2.3 | | APS-72 | Wait a few days before taking new releases | Not covered | | APS-73 | Fetch private packages only from your own registry | 15.2.4 | | APS-74 | Keep secrets out of builds from strangers | Not covered | | APS-75 | Publish what is in each release | 15.1.2 | | APS-76 | Treat a machine that installed a bad package as breached | Not covered | | APS-77 | Use models and data from trusted sources | Not covered | | APS-104 | Build releases at SLSA Build Level 2 or higher | Not covered | | APS-105 | Verify signatures and provenance before you install or deploy | 15.2.4 | | APS-106 | Say which known holes do not affect you with VEX | 15.1.1 | ## Errors, logs and vulnerabilities | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-78 | Show short errors | 16.5.1, 16.5.4 | | APS-79 | Keep private data out of logs and addresses | 14.2.1, 16.2.5 | | APS-80 | Log attacks without personal data | 16.3.1, 16.3.2, 16.3.3, 16.4.3 | | APS-81 | Fix each finding within the time its severity allows | 15.1.1, 15.2.1 | | APS-107 | Publish a vulnerability disclosure policy | Not covered | | APS-108 | Keep a security incident runbook and rehearse it | Not covered | ## AI features and agents | Rule | Title | ASVS 5.0 | | --- | --- | --- | | APS-82 | Resist direct prompt injection | Not covered | | APS-83 | Resist indirect prompt injection | Not covered | | APS-84 | Break the lethal trifecta | Not covered | | APS-85 | Give agent tools the least power they need | Not covered | | APS-86 | Treat model output as untrusted | 1.3.2 | | APS-87 | Keep secrets out of the system prompt | Not covered | | APS-88 | Protect agent memory | Not covered | | APS-89 | Send models only the private data they need | 14.2.3 | | APS-90 | Keep a switch that turns the agent off | Not covered | | APS-91 | Run code the model writes in a sandbox | 15.2.5 | | APS-92 | Lock local agent servers to your own machine | Not covered | - Previous: [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md) - [All chapters](https://agentwranglers.se/playbook/application-security.md)