Agent Wranglers

APS-96Recommended

Pick an ASVS level for each app

Choose an OWASP ASVS 5.0 level for each app and write it in the repository. Check the app against every requirement of that level before each major release.

By Agent Wranglers. Updated .

How to do it

Level 1 is the floor for any app on the internet. Level 2 suits most apps that hold personal data, money or business records. Level 3 is for apps where a breach would cause serious harm, such as health or payment systems. Keep a list of the requirement IDs at your level, each with a status and the rule or test that meets it. The ASVS 5.0 mapping shows which rules in this playbook meet which requirements. A buyer's security questionnaire often asks for this list. Note the level in the threat model, since it sets how deep each review goes.

Examples

YAML example

# asvs.yaml
level: 2
requirements:
  "1.2.4": { status: met, by: tests/db/parameterised.test.js }
  "3.4.1": { status: met, by: tests/headers/hsts.test.js }
  "11.1.2": { status: open, owner: platform-team, due: 2027-01-31 }

How to check

The repository holds a file that names the level and lists every requirement ID of that level. A script fails when any listed requirement has no status, or a status of met without a linked rule or test.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/threat-modelling/asvs-level">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.