Standards

Crosswalk

Which guide, fix card or lab answers a CWE, an OWASP Top 10, API, LLM, Agentic, Kubernetes or CI/CD risk, an ASVS 5.0 requirement, a MASVS control or an NIST SSDF practice. The table is built from the content itself, so a new guide appears with its mappings at the next build.

213guides
30fix card weaknesses
38labs

Download the crosswalk as JSON or CSV (one line per item and identifier, with CAPEC).

Find an item or identifierTypeTopicMaps to

281 items

Item	CWE	OWASP Top 10:2025	API Security 2023	ASVS 5.0.0	LLM and Agentic 2026	SSDF 1.1	Kubernetes, CI/CD and MASVS
Fix SQL injection in Python sqlite3 · Guide	CWE-89	A05:2025	—	V1 V1.2.4	—	—	—
Enforce authorization for every object action · Guide	CWE-639 CWE-862 CWE-284 CWE-863	A01:2025	API1:2023	V8 V8.2.2 V8.3.1 V8.4.1	—	—	—
Design a safer file-upload pipeline · Guide	CWE-434 CWE-770	A06:2025	API4:2023	V5 V5.2.1 V5.2.2 V5.2.6 V5.3.2 V5.4.1	—	—	—
Verify webhook deliveries before acting · Guide	CWE-347 CWE-306 CWE-208 CWE-294	A07:2025 A08:2025 Derived: A04:2025	API10:2023	V2 V4	—	—	—
Review tenant boundaries before implementation · Guide	CWE-639 CWE-863	A06:2025 A01:2025	API1:2023	V8 V8.4.1	—	—	—
Respond to an exploited or malicious dependency · Guide	CWE-506 CWE-1104 CWE-1395	A03:2025 Derived: A08:2025	—	V15 V15.1.1 V15.1.2 V15.2.1	—	—	—
Start a minimal AppSec program with owners, triggers and metrics · Guide	—	—	—	—	—	—	—
Protect the path from pull request to release · Guide	CWE-829	A03:2025 A08:2025	—	—	—	—	CICD-SEC-1 CICD-SEC-4 CICD-SEC-9
Review infrastructure changes as access changes · Guide	CWE-312 CWE-732	A02:2025 Derived: A01:2025 A06:2025	—	V13 V13.2.2 V13.3.1 V13.3.2	—	—	—
Contain prompt injection at the application boundary · Guide	CWE-863 CWE-1427	Derived: A01:2025	—	V8.3.1	LLM01:2026 LLM03:2026 LLM08:2026 LLM10:2026 ASI01:2026 ASI02:2026	—	—
Secrets management: storage, rotation and leaked-secret response · Guide	CWE-522 CWE-532 CWE-798	A04:2025 A09:2025 Derived: A06:2025 A07:2025	—	V13 V11.5.1 V13.1.4 V13.3.1 V13.3.2 V13.3.4	—	—	—
Review trust boundaries in mobile and native clients · Guide	CWE-639 CWE-602 CWE-939	A01:2025 A06:2025	API1:2023	V8 V2.2.2 V8.3.1	—	—	MASVS-AUTH-1 MASVS-PLATFORM-1 MASVS-RESILIENCE-1 MASVS-RESILIENCE-3 MASVS-RESILIENCE-4 MASVS-STORAGE-1
ECB mode: why it leaks patterns and what to use instead · Guide	CWE-327	A04:2025	—	V11 V11.3.1 V11.3.2 V11.3.3	—	—	—
Padding oracle attacks · Guide	CWE-208 CWE-327 CWE-353	A04:2025 Derived: A08:2025	—	V11 V11.2.5 V11.3.3 V11.3.5	—	—	—
Hash collisions and digital signatures: MD5, SHA-1 and what to use · Guide	CWE-327 CWE-328 CWE-347	A04:2025	—	V11 V11.4.1 V11.4.3	—	—	—
Weak RSA key generation: shared primes, ROCA and safe keys · Guide	CWE-326 CWE-331	A04:2025	—	V11 V11.2.3 V11.5.1 V11.6.1	—	—	—
RC4 keystream bias · Guide	CWE-327	A04:2025	—	V11 V12 V11.3.2 V12.1.2	—	—	—
64-bit block ciphers and the Sweet32 mechanism · Guide	CWE-327 CWE-326	A04:2025	—	V11 V12 V11.3.2 V12.1.2	—	—	—
WEP: RC4 key reuse and weak IVs · Guide	CWE-327 CWE-323 CWE-353	A04:2025 Derived: A08:2025	—	V11 V11.3.3 V11.3.4	—	—	—
Flame: MD5 certificate forgery · Guide	CWE-327 CWE-295 CWE-328	A04:2025 A08:2025 Derived: A07:2025	—	V11 V11.4.1 V11.4.3	—	—	—
Lucky Thirteen and POODLE: two different oracles · Guide	CWE-208 CWE-327 CWE-757	A04:2025	—	V11 V12 V11.2.5 V12.1.1 V12.1.2	—	—	—
FREAK and Logjam: export-grade key exchange · Guide	CWE-326 CWE-757	A04:2025	—	V11 V12 V11.6.2 V12.1.1 V12.1.2	—	—	—
DROWN: one RSA key across incompatible protocols · Guide	CWE-327	A04:2025	—	V11 V12 V11.3.1 V12.1.1 V12.1.2	—	—	—
Sweet32: the cost of a small block size · Guide	CWE-327 CWE-326	A04:2025	—	V11 V12 V12.1.2	—	—	—
ROCA: structured RSA key generation · Guide	CWE-326 CWE-1240	A04:2025	—	V11 V11.6.1	—	—	—
Prevent XSS at the output boundary · Guide	CWE-79 CWE-116	A05:2025	—	V1 V3 V1.2.1 V1.2.2 V1.3.1 V3.2.2	—	—	—
Constrain server-side fetches to their intended destinations · Guide	CWE-918	A01:2025	API7:2023 API10:2023	V1 V13 V15 V1.3.6 V13.2.4 V15.3.2	—	—	—
Session management: cookies, timeouts, rotation and revocation · Guide	CWE-384 CWE-614 CWE-1004 CWE-1275 CWE-613	A07:2025 Derived: A01:2025 A02:2025	API2:2023	V7 V6 V3.3.1 V3.3.3 V7.2.3 V7.2.4 V7.3.1 V7.3.2 V7.4.1 V7.4.2 V7.5.1	—	—	—
Password storage: hashing parameters and rehash on login · Guide	CWE-916 CWE-257 CWE-521 CWE-759 CWE-760	A04:2025 A07:2025	API2:2023	V11 V6 V6.2.1 V6.2.8 V6.2.9 V6.2.12 V11.4.2	—	—	—
Bound API work, not just request counts · Guide	CWE-400 CWE-770	A06:2025	API4:2023	V2 V15 V15.1.3 V15.2.2	—	—	—
Create security logs someone can investigate · Guide	CWE-778 CWE-117 CWE-532	A09:2025	—	V16 V16.2.1 V16.2.5 V16.3.2 V16.4.1 V16.4.3	—	—	—
Handle failures without leaking internals or weakening controls · Guide	CWE-209 CWE-200 CWE-460 CWE-489 CWE-636	A10:2025 Derived: A01:2025 A02:2025	API8:2023	V16 V2 V13.4.2 V16.5.1 V16.5.3	—	—	—
Ship without debug modes, verbose errors or exposed files · Guide	CWE-200 CWE-209 CWE-215 CWE-548 CWE-489 CWE-527 CWE-538	A02:2025 Derived: A01:2025 A10:2025	—	V13 V13.4 V16.5.1	—	—	—
Run coordinated vulnerability disclosure from report to advisory · Guide	—	—	—	—	—	—	—
Protect cookie-authenticated actions against CSRF · Guide	CWE-352 CWE-1275	A01:2025	—	V3 V3.3.2 V3.3.3 V3.5.1 V3.5.2 V3.5.3	—	—	—
Configure CORS and CSP around the browser capabilities you need · Guide	CWE-942 CWE-79 CWE-352 CWE-346 CWE-1021	A02:2025 A01:2025 A05:2025 Derived: A06:2025 A07:2025	API8:2023	V3 V3.4.2 V3.4.3 V3.4.6 V3.4.7 V3.5.2	—	—	—
Render rich text without granting it application privileges · Guide	CWE-79 CWE-346	A05:2025 Derived: A07:2025	—	V1 V3 V1.3.1 V1.3.5 V3.2.2 V3.2.3 V3.5.5	—	—	—
Authorize functions and fields as well as objects · Guide	CWE-862 CWE-915 CWE-284 CWE-863 CWE-213	A01:2025 A08:2025	API3:2023 API5:2023	V8 V15 V8.2.1 V8.2.3 V15.3.1 V15.3.3	—	—	—
Preserve business invariants under concurrent requests · Guide	CWE-362 CWE-367 CWE-837	A06:2025	—	V2 V15 V2.3.3 V2.3.4 V15.4.2	—	—	—
Keep untrusted values out of executable syntax · Guide	CWE-77 CWE-78 CWE-88 CWE-94 CWE-502 CWE-611 CWE-1336 CWE-90 CWE-917 CWE-943	A05:2025 A02:2025 A08:2025	—	V1 V1.2.4 V1.2.5 V1.2.6 V1.3.2 V1.3.7 V1.5.1 V1.5.2	—	—	—
Run external programs without command or argument injection · Guide	CWE-77 CWE-78 CWE-88	A05:2025	—	V1 V1.2.5 V1.2.8 V2.2.1	—	—	—
Keep untrusted input out of eval, expression languages and templates · Guide	CWE-94 CWE-95 CWE-917 CWE-1336	A05:2025	—	V1 V1.3.2 V1.3.7	—	—	—
Extract archives without escaping the destination · Guide	CWE-22 CWE-770 CWE-23 CWE-36 CWE-59 CWE-409	A01:2025	API4:2023	V5 V5.2.3 V5.2.5 V5.3.3	—	—	—
Convert untrusted office documents and PDFs in an isolated parser · Guide	CWE-22 CWE-400 CWE-409 CWE-611 CWE-918	A01:2025 A02:2025	—	V1.5.1 V5.2.2 V5.2.3 V15.2.5	—	—	—
Secure WebRTC signaling, TURN relays and media servers · Guide	CWE-770 CWE-295 CWE-359 CWE-441	Derived: A01:2025 A07:2025	—	V17 V17.1.1 V17.1.2 V17.2.1 V17.2.2 V17.2.3 V17.2.4 V17.2.5 V17.2.6 V17.2.7 V17.2.8 V17.3.1 V17.3.2	—	—	—
Review a code change through its trust boundaries · Guide	CWE-639 CWE-862	A01:2025	API1:2023	V8 V8.2.2 V8.3.1	—	Derived: PW.7	—
Combine static and dynamic tests around a verified finding · Guide	CWE-89	A05:2025	—	V1	—	—	—
Fuzz a parser and turn crashes into lasting regressions · Guide	CWE-125 CWE-130 CWE-1284	—	—	V1 V1.4.1 V1.4.2	—	—	—
Preserve framework security controls across the request lifecycle · Guide	CWE-352 CWE-288 CWE-489 CWE-1188	A01:2025 A02:2025 Derived: A07:2025	—	V13 V3.3.1 V3.4.1 V3.4.3 V13.4.2 V15.3.4	—	—	—
Review mobile storage, links and platform permissions · Guide	CWE-295 CWE-532 CWE-922 CWE-926 CWE-939	Derived: A01:2025 A07:2025 A08:2025 A09:2025	—	—	—	—	MASVS-NETWORK-1 MASVS-PLATFORM-1 MASVS-PLATFORM-3 MASVS-RESILIENCE-1 MASVS-STORAGE-1 MASVS-STORAGE-2
Constrain desktop IPC and privileged helpers · Guide	CWE-250 CWE-346 CWE-749 CWE-940	A01:2025 Derived: A07:2025	—	—	—	—	—
Design firmware updates that can recover safely · Guide	CWE-494 CWE-347 CWE-1277 CWE-1329	A08:2025 A03:2025 Derived: A04:2025	—	—	—	—	—
Run Kubernetes workloads with only the privileges they need · Guide	CWE-250	A02:2025	—	—	—	—	K01:2025 K02:2025 K04:2025 K09:2025
Prove network and admission policies enforce the intended boundary · Guide	—	A02:2025 A08:2025	—	—	—	—	K04:2025 K05:2025
Review cloud permissions and role trust together · Guide	CWE-250 CWE-284 CWE-863	A02:2025 A01:2025	—	—	—	—	—
Test infrastructure policy and detect security-relevant drift · Guide	—	A02:2025	—	—	—	—	—
Prevent subdomain takeover from dangling DNS records · Guide	—	A02:2025	—	V3 V3.3.3 V3.4.2 V10.4.1	—	—	—
Maintain an API inventory and prevent gateway bypass · Guide	CWE-306 CWE-290 CWE-348	A01:2025 A07:2025	API9:2023 API2:2023 API8:2023	V4 V14 V4.1.3	—	—	—
Apply security limits to GraphQL, WebSocket and gRPC operations · Guide	CWE-400 CWE-770 CWE-307 CWE-1385	Derived: A07:2025	API4:2023 API2:2023	V4 V4.3.1 V4.3.2 V4.4.1 V4.4.2	—	—	—
Bound background jobs and make retries safe · Guide	CWE-362 CWE-400 CWE-770	A10:2025 Derived: A06:2025	API4:2023 API10:2023	V15 V15.2.2 V16.5.2	—	—	—
Authenticate workloads and authorize their service actions · Guide	CWE-295 CWE-863	A01:2025 A07:2025	API2:2023 API5:2023	V12 V8 V13 V8.2.1 V12.3.3 V12.3.5	—	—	—
Turn runtime events into a tested investigation and containment path · Guide	CWE-778	A09:2025	—	V16	—	—	K10:2025
Operate edge rules without hiding application defects · Guide	CWE-444	A07:2025 Derived: A06:2025	API2:2023 API6:2023 API8:2023	V2 V6 V14 V2.4.1 V6.3.1	—	—	—
Generate an SBOM for the software you actually release · Guide	—	A03:2025	—	V15 V15.1.2	—	—	—
Choose SBOM formats and identify components accurately · Guide	—	A03:2025	—	—	—	—	—
Review SBOM changes between releases · Guide	—	A03:2025	—	—	—	—	—
Triage new dependency vulnerability findings · Guide	CWE-1104 CWE-1395	A03:2025	—	V15 V15.1.1 V15.2.1	—	—	—
Verify artifact signatures against an explicit trust policy · Guide	CWE-347 CWE-494	A03:2025 A08:2025 Derived: A04:2025	—	—	—	—	K04:2025 CICD-SEC-9
Read SLSA provenance and verify the claim you need · Guide	CWE-494	A03:2025 A08:2025	—	—	—	—	CICD-SEC-9
Keep untrusted CI work outside the release boundary · Guide	CWE-829 CWE-78 CWE-94	A03:2025 A08:2025 A05:2025	—	—	—	—	CICD-SEC-4 CICD-SEC-5
Investigate a suspected malicious package safely · Guide	CWE-506 CWE-1357	A03:2025 A08:2025	—	V15.2.4	—	—	CICD-SEC-3
Use VEX without losing vulnerability evidence · Guide	—	A03:2025	—	—	—	—	—
Investigate build differences and improve reproducibility · Guide	—	A03:2025 A08:2025	—	—	—	—	—
Review dependency health without treating a score as a guarantee · Guide	CWE-1357 CWE-1104	A03:2025	—	V15 V15.1.2 V15.1.4	—	—	—
Protect package publication and the update channel · Guide	CWE-494	A03:2025 A08:2025	—	—	—	—	CICD-SEC-6 CICD-SEC-9
Run an AppSec program: owners, finding states, deadlines and champions · Guide	—	—	—	—	—	—	—
ASVS 5.0 verification records: requirement, test and evidence another engineer can repeat · Guide	CWE-78	A05:2025	—	V1 V1.2.5	—	—	—
Apply NIST SSDF (SP 800-218) to one product: practices, evidence and attestation in 2026 · Guide	—	—	—	—	—	Derived: PO.1 PO.2 PO.3 PO.4 PO.5 PS.1 PS.2 PS.3 PW.1 PW.2 PW.4 PW.5 PW.6 PW.7 PW.8 PW.9 RV.1 RV.2 RV.3	—
Run an OWASP SAMM assessment with evidence and a practical roadmap · Guide	—	—	—	—	—	—	—
Approve, expire and measure security exceptions without hiding risk · Guide	—	—	—	—	—	—	—
Control mapping between frameworks: state the relationship without overstating equivalence · Guide	—	—	—	—	—	—	—
Supplier software assurance: check SOC 2 reports, SBOMs and signed updates against your use · Guide	CWE-1357	A03:2025	—	—	—	—	—
Cyber Resilience Act and payment pages: turn product-security obligations into an engineering evidence plan · Guide	—	—	—	—	—	—	—
ISO 27001, SOC 2, NIST CSF or FedRAMP: choose the framework by the question it answers · Guide	—	—	—	—	—	—	—
GDPR, CCPA, HIPAA or the FTC rule: scope privacy and health-data obligations before choosing controls · Guide	—	—	—	V14	—	—	—
OAuth 2.0 and OpenID Connect login: authorization code with PKCE · Guide	CWE-294 CWE-346 CWE-352 CWE-601	A07:2025 Derived: A01:2025	API2:2023	V10 V6 V9 V10.1.1 V10.2.1 V10.2.2 V10.4.1 V10.4.5 V10.5.1 V10.5.2 V10.5.4	—	—	MASVS-AUTH-1
JWT validation: algorithms, keys, claims and key rollover · Guide	CWE-347 CWE-290 CWE-918	A07:2025 A04:2025 Derived: A01:2025	API2:2023	V9 V10 V9.1.1 V9.1.2 V9.1.3 V9.2.1 V9.2.2 V9.2.3	—	—	—
Passkeys and MFA: WebAuthn enrollment, sign-in and replacement · Guide	CWE-294 CWE-308 CWE-1390	A07:2025	API2:2023	V6 V6.3.3 V6.4.3 V6.5.1 V6.6.1 V6.6.4 V6.7.2	—	—	—
Account recovery: password resets, help-desk resets and account linking · Guide	CWE-362 CWE-204 CWE-640	A07:2025 Derived: A06:2025	API2:2023	V6 V7 V6.3.7 V6.3.8 V6.4.3 V6.4.4 V7.4.3 V11.5.1	—	—	—
AEAD records: AES-GCM nonces, associated data and key limits · Guide	CWE-323 CWE-327 CWE-353	A04:2025 Derived: A08:2025	—	V11 V11.2.1 V11.3.2 V11.3.3 V11.3.4	—	—	—
Envelope encryption and key rotation: data keys, KMS keys and backups · Guide	CWE-321 CWE-323 CWE-324	A04:2025	—	V11 V13 V11.1.1 V11.1.2 V11.3.3 V11.3.4 V13.3.1 V13.3.3	—	—	—
Operate TLS and certificates: configuration, renewal and verification · Guide	CWE-295 CWE-297 CWE-298 CWE-319	A04:2025 A07:2025	API8:2023	V12 V3.4.1 V12.1.1 V12.1.2 V12.2.2 V12.3.2 V12.3.4	—	—	—
Workload identity federation: short-lived, scoped identities for services and CI · Guide	CWE-250 CWE-290 CWE-863	A07:2025 A01:2025	API2:2023	V13 V13.2.1 V13.2.2 V13.3.1	—	—	K03:2025 CICD-SEC-6
Authorization models: RBAC, ABAC, ReBAC and policy as code you can test · Guide	CWE-284 CWE-863 CWE-639 CWE-862	A01:2025	API1:2023 API3:2023 API5:2023	V8 V8.2.1 V8.2.2 V8.2.3 V8.3.1 V8.3.3 V8.4.1	—	—	—
Data minimization and retention: collect less and prove that deletion works · Guide	CWE-359 CWE-532	Derived: A01:2025 A09:2025	—	V14 V11.7.2 V14.1.2 V14.2.6 V14.2.7	—	—	—
Tokenization, pseudonymization and privacy transformations: choose deliberately · Guide	CWE-328 CWE-359	Derived: A01:2025 A04:2025	—	V14 V14.1.1 V14.2.4 V14.2.6	—	—	MASVS-PRIVACY-2
Post-quantum migration: cryptographic inventory, hybrid TLS and deadlines · Guide	CWE-327 CWE-326	A04:2025	—	V11 V11.1.2 V11.1.3 V11.1.4 V11.2.2 V11.2.3	—	—	—
Keep retrieval inside the user’s data boundary · Guide	CWE-863	A01:2025	—	V8 V8.2.2 V8.4.1 V14.2.2	LLM09:2026 LLM02:2026 ASI06:2026	—	—
Authorize agent tools outside the model · Guide	CWE-367 CWE-863	Derived: A01:2025	—	V8 V8.3.1 V8.3.2 V15.4.2	LLM03:2026 LLM01:2026 ASI02:2026 ASI09:2026 ASI03:2026	—	—
Keep generated output out of executable contexts · Guide	CWE-79 CWE-78 CWE-89	A05:2025	—	V1 V3 V1.2.4 V1.2.5 V1.3.1 V3.2.2	LLM10:2026 LLM07:2026 ASI05:2026	—	—
Build evaluations around prohibited outcomes · Guide	—	—	—	—	LLM07:2026	—	—
Red-team LLM applications and agents by their effects · Guide	CWE-1427	—	—	—	LLM01:2026 LLM02:2026 LLM03:2026 LLM06:2026 LLM08:2026 LLM10:2026 ASI01:2026 ASI02:2026 ASI03:2026 ASI06:2026	—	—
Bound agent spending, memory and recovery · Guide	CWE-400 CWE-770	—	API4:2023	V15.4.2	LLM06:2026 LLM01:2026 ASI06:2026	—	—
Treat model releases as executable supply-chain inputs · Guide	CWE-494 CWE-502 CWE-829	A03:2025 A08:2025	—	V1.5.2 V15.2.4 V15.2.5	LLM04:2026	—	—
Protect training and retrieval data from targeted poisoning · Guide	—	—	—	—	LLM05:2026	—	—
Assess extraction, membership and inference risks · Guide	CWE-359	Derived: A01:2025	—	—	LLM02:2026	—	—
Constrain MCP and multi-agent trust boundaries · Guide	CWE-829 CWE-441 CWE-639 CWE-863 CWE-918	Derived: A01:2025 A08:2025	—	V8 V10 V8.2.2 V10.2.2 V10.3.1 V10.3.3 V10.4.1	LLM01:2026 LLM03:2026 ASI03:2026 ASI04:2026 ASI07:2026 ASI01:2026 ASI02:2026	—	—
Contain cascading failures and rogue agents · Guide	CWE-770	—	—	V2.4.1 V8.3.2 V16.4.3 V16.5.2	LLM06:2026 ASI08:2026 ASI10:2026	—	—
Turn NIST AI RMF, ISO/IEC 42001 and EU AI Act duties into engineering evidence · Guide	—	—	—	—	—	—	—
Test smart contracts through state invariants · Guide	CWE-841 CWE-1265	Derived: A06:2025	—	—	—	—	—
Keep HTTP request boundaries consistent across intermediaries · Guide	CWE-444	A06:2025	API8:2023	V4 V4.2.1 V4.2.2 V4.2.3	—	—	—
Prevent shared-cache poisoning and private-response deception · Guide	CWE-524 CWE-200	A01:2025 A02:2025	API8:2023	V14 V14.2.2 V14.2.5	—	—	—
Parse bounded JSON and XML into an explicit application schema · Guide	CWE-20 CWE-502 CWE-611 CWE-400 CWE-770 CWE-776	A05:2025 A08:2025 A02:2025	API4:2023	V1 V2 V15 V1.5.1 V1.5.2 V1.5.3 V2.2.1	—	—	—
SAML single sign-on: verify signed assertions without losing the identity boundary · Guide	CWE-347 CWE-290 CWE-294 CWE-611	A07:2025 A04:2025 Derived: A02:2025	API2:2023	V6 V6.8.1 V6.8.2 V6.8.3	—	—	—
SCIM deprovisioning: make account disablement remove every usable authority · Guide	CWE-613 CWE-863	A01:2025 A07:2025	—	V7 V8 V7.4.2 V8.3.2 V8.4.1	—	—	—
Keep untrusted object keys out of prototype and authority paths · Guide	CWE-1321 CWE-20 CWE-915	A05:2025 A08:2025	API3:2023	V15 V15.3.3 V15.3.6	—	—	—
Harden an Android app's storage, network and entry points · Guide	CWE-295 CWE-312 CWE-319 CWE-532 CWE-749 CWE-926 CWE-927 CWE-939	A01:2025 A02:2025 A04:2025 A07:2025 A08:2025 Derived: A06:2025 A09:2025	—	—	—	—	MASVS-AUTH-2 MASVS-AUTH-3 MASVS-CODE-1 MASVS-CODE-4 MASVS-CRYPTO-1 MASVS-CRYPTO-2 MASVS-NETWORK-1 MASVS-NETWORK-2 MASVS-PLATFORM-1 MASVS-PLATFORM-2 MASVS-PLATFORM-3 MASVS-RESILIENCE-1 MASVS-RESILIENCE-2 MASVS-STORAGE-1 MASVS-STORAGE-2
Prevent business-logic flaws with server-side invariants · Guide	CWE-472 CWE-602 CWE-640 CWE-799 CWE-837 CWE-839 CWE-841 CWE-1284	A06:2025 A07:2025	API6:2023	V2.2 V2.3 V2.4 V6.4	—	—	—
Case study: Log4Shell (CVE-2021-44228) · Guide	CWE-400 CWE-502 CWE-917 CWE-674 CWE-1104	A05:2025 A08:2025 A03:2025	—	V1 V15	—	Derived: PS.3.2 PW.1.1 PW.5.1 PW.9.1 RV.1.1 RV.1.3 RV.2.2 RV.3.3	—
Prevent CRLF header injection, log forging and CSV formula injection · Guide	CWE-117 CWE-93 CWE-113 CWE-1236	A05:2025 A09:2025	—	V1.2 V4.2 V16.4	—	—	—
Place each security control in the pipeline and decide what it blocks · Guide	CWE-494 CWE-798 CWE-1104 CWE-1395	A03:2025 A02:2025 A08:2025 Derived: A07:2025	—	V13.3 V15.1 V15.2	—	Derived: PS.2.1 PS.3.2 PW.4.4 PW.7.2 PW.8.2	—
Choose and evaluate application security testing tools · Guide	—	A03:2025 A05:2025	—	V15.1 V15.2	—	—	—
Prevent DOM XSS, postMessage abuse and client-side injection · Guide	CWE-79 CWE-95 CWE-346 CWE-1336	A05:2025 Derived: A07:2025	—	V1.2 V1.3 V3.2 V3.5	—	—	—
Harden an iOS app's storage, network and entry points · Guide	CWE-295 CWE-312 CWE-319 CWE-532 CWE-602 CWE-749 CWE-939 CWE-940	A01:2025 A02:2025 A04:2025 A06:2025 A07:2025 Derived: A09:2025	—	—	—	—	MASVS-AUTH-2 MASVS-AUTH-3 MASVS-CODE-4 MASVS-CRYPTO-1 MASVS-CRYPTO-2 MASVS-NETWORK-1 MASVS-NETWORK-2 MASVS-PLATFORM-1 MASVS-PLATFORM-2 MASVS-PLATFORM-3 MASVS-PRIVACY-1 MASVS-PRIVACY-3 MASVS-RESILIENCE-1 MASVS-RESILIENCE-2 MASVS-STORAGE-1 MASVS-STORAGE-2
Find, fix and contain memory-safety bugs in C and C++ · Guide	CWE-120 CWE-121 CWE-122 CWE-125 CWE-416 CWE-476 CWE-787 CWE-190	A10:2025	—	V1.4	—	—	—
Prevent NoSQL, LDAP, XPath and expression-language injection · Guide	CWE-917 CWE-90 CWE-643 CWE-943 CWE-1287	A05:2025	—	V1.2 V1.3 V15.3	—	—	—
Redirect users only to destinations you control · Guide	CWE-601	A01:2025	—	V3 V10	—	—	—
Validate input safely and prevent regex denial of service · Guide	CWE-20 CWE-180 CWE-235 CWE-777 CWE-1287 CWE-1333	A05:2025 Derived: A10:2025	API4:2023	V1.1 V1.2 V1.3 V2.2 V15.3	—	—	—
Audit unsafe Rust, FFI boundaries and crate dependencies · Guide	CWE-416 CWE-1357 CWE-190 CWE-617 CWE-758 CWE-762 CWE-1395	A03:2025 A10:2025	—	V1.4 V15.1 V15.2	—	—	—
Configure HTTP security headers from a tested baseline · Guide	CWE-614 CWE-1004 CWE-319 CWE-1021	A02:2025 A04:2025 A06:2025	API8:2023	V3	—	—	—
Choose a threat modeling method and turn its findings into tests · Guide	—	A06:2025	—	—	—	Derived: PW.1.1 PW.1.2	—
Start with a VDP, then add bug bounties and penetration tests · Guide	—	—	—	—	—	—	—
Case study: the Shai-Hulud npm worm (2025-2026) · Guide	CWE-506 CWE-829 CWE-522 CWE-1357	A03:2025 A08:2025 Derived: A06:2025	—	V13.3 V15.2	—	Derived: PO.3.2 PO.5.1 PO.5.2 PS.1.1 PW.4.1 PW.4.4 RV.1.1 RV.2.2	CICD-SEC-3
Case study: the tj-actions/changed-files compromise (CVE-2025-30066) · Guide	CWE-506 CWE-494 CWE-532 CWE-829	A03:2025 A08:2025 Derived: A09:2025	—	V13.3	—	Derived: PO.3.2 PO.5.1 PS.1.1 PS.2.1 PW.4.1 PW.4.4 RV.2.2	CICD-SEC-4 CICD-SEC-6 CICD-SEC-8 CICD-SEC-10
Case study: the xz Utils backdoor (CVE-2024-3094) · Guide	CWE-506 CWE-494 CWE-1357 CWE-912	A03:2025 A08:2025	—	V15	—	Derived: PO.3.2 PS.1.1 PS.2.1 PS.3.2 PW.4.1 PW.4.4 PW.7.2 RV.1.1	—
Case study: the SolarWinds Orion build compromise (SUNBURST) · Guide	CWE-506 CWE-912	A03:2025 A08:2025	—	—	—	Derived: PO.5 PS.2 PW.6 RV.1	—
Case study: the Codecov Bash Uploader compromise (2021) · Guide	CWE-494 CWE-506	A03:2025 A08:2025	—	—	—	Derived: PO.3 PO.5 PS.1 PW.4 RV.2	CICD-SEC-5 CICD-SEC-8 CICD-SEC-9
Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059) · Guide	CWE-506	A03:2025 A08:2025	—	—	—	Derived: PO.5 PS.2 PW.4 PW.6 RV.1	—
Case study: event-stream and ua-parser-js, two npm package takeovers · Guide	CWE-506 CWE-829 CWE-1357	A03:2025 A08:2025	—	—	—	Derived: PO.5 PS.1 PS.2 PW.4	—
Case study: the polyfill.io CDN takeover (2024) · Guide	CWE-494 CWE-829	A03:2025 A08:2025	—	—	—	Derived: PW.4	—
Case study: MOVEit Transfer mass exploitation (CVE-2023-34362) · Guide	CWE-89	A05:2025	—	—	—	Derived: PW.5 PW.7 PW.8 RV.2 RV.3	—
Stop dependency confusion and typosquatting at install time · Guide	CWE-494 CWE-829 CWE-1357 CWE-427 CWE-1104	A03:2025 A08:2025	—	V15.1.2 V15.2.4	LLM04:2026	—	CICD-SEC-3
Harden GitHub Actions against workflow and supply-chain attacks · Guide	CWE-94 CWE-829 CWE-95 CWE-116 CWE-275 CWE-349	A03:2025 A05:2025 A08:2025	—	V1.2.5 V13.3.1 V13.3.2	—	—	CICD-SEC-4 CICD-SEC-1 CICD-SEC-5 CICD-SEC-6 CICD-SEC-7 CICD-SEC-8
Protect the source repository: rulesets, reviews and signed commits · Guide	CWE-284 CWE-1357	A03:2025 A08:2025 Derived: A01:2025	—	V15	—	—	CICD-SEC-1 CICD-SEC-2 CICD-SEC-6 CICD-SEC-9
Secure the developer workstation: extensions, package managers, secrets and AI agents · Guide	CWE-506 CWE-522 CWE-829	A03:2025 A08:2025 Derived: A06:2025	—	—	—	—	CICD-SEC-3
Open source license compliance: SPDX expressions, obligations and SBOM checks · Guide	—	—	—	—	—	—	—
Apply a security baseline across AWS, Azure and Google Cloud · Guide	CWE-918 CWE-732 CWE-778 CWE-798 CWE-1188	A02:2025 A01:2025 A07:2025 A09:2025	—	V13.2 V13.3 V16.4	—	—	K08:2025
Detect container and host threats at runtime with eBPF sensors and cloud services · Guide	CWE-778	A09:2025	—	V16	—	—	K08:2025 K10:2025
Harden managed Kubernetes on EKS, AKS and GKE · Guide	CWE-250 CWE-269 CWE-284 CWE-1188	A01:2025 A02:2025 Derived: A06:2025	—	V13	—	—	K07:2025 K01:2025 K02:2025 K04:2025 K06:2025 K08:2025 K09:2025
Keep HTTP services up under application-layer DDoS · Guide	CWE-400 CWE-770	—	API4:2023	—	—	—	—
Choose cloud security posture tools and apply zero trust · Guide	CWE-250 CWE-732 CWE-1188	A01:2025 A02:2025	—	—	—	—	—
Harden container images from Dockerfile to admission · Guide	CWE-250 CWE-494 CWE-538 CWE-1395	A02:2025 A03:2025 A08:2025 Derived: A01:2025	—	V13 V15	—	—	K01:2025 K03:2025 K04:2025
Harden the images you ship against CIS, STIG and SCAP benchmarks · Guide	CWE-1188	A02:2025	—	—	—	—	K07:2025
Meet the OpenSSF OSPS Baseline as a maintainer: the levels, every Level 1 control on GitHub, and the evidence · Guide	—	—	—	—	—	—	CICD-SEC-1
Adopt the OpenSSF S2C2F as a consumer: the eight practices, the four maturity levels and a staged plan with evidence · Guide	—	—	—	—	—	Derived: PO.5.2 PW.4.1	CICD-SEC-3
Choose cryptographic algorithms and parameters by job · Guide	CWE-327 CWE-347 CWE-916 CWE-323 CWE-326 CWE-328 CWE-338 CWE-757	A04:2025	—	V11.2 V11.3 V11.4 V11.5 V11.6 V12.1	—	—	MASVS-CRYPTO-1
Defend JWTs against forgery, confusion and replay · Guide	CWE-347 CWE-287 CWE-290 CWE-326 CWE-613 CWE-918	A07:2025 A01:2025 A04:2025	API2:2023	V7 V9 V10	—	—	—
Contain a leaked secret, then investigate and clean up · Guide	CWE-532 CWE-321 CWE-522 CWE-540 CWE-798	A07:2025 A02:2025 A04:2025 Derived: A01:2025 A06:2025 A09:2025	—	V13.2 V13.3	—	—	CICD-SEC-6
Stop account takeover with the right MFA and login defenses · Guide	CWE-204 CWE-208 CWE-294 CWE-307 CWE-308 CWE-521 CWE-640	A07:2025	API2:2023	V2.4 V6.2 V6.3 V6.4 V6.5 V6.6	—	—	—
Defend OAuth and OIDC against redirect and token attacks · Guide	CWE-352 CWE-287 CWE-294 CWE-346 CWE-601	A07:2025 A01:2025	API2:2023	V3 V7 V10	—	—	—
Set remediation SLAs and measure AppSec outcomes · Guide	—	—	—	V15	—	Derived: PO.4.1 RV.2 RV.3 RV.3.2 RV.3.3	—
Build a runbook for CRA vulnerability and incident reporting · Guide	—	A03:2025 A08:2025	—	—	—	—	—
Map PCI DSS Requirement 6 to engineering practice and evidence · Guide	CWE-494 CWE-829 CWE-1395	A03:2025 A08:2025	—	V3.6 V15.1 V15.2	—	—	—
Run a security champions program with protected time and outcome metrics · Guide	—	—	—	—	—	Derived: PO.2.1 PO.2.2	—
Prioritize vulnerabilities by exploitation, exposure and impact · Guide	CWE-1395	A03:2025	—	V15	—	—	—
Secure AI-assisted development with coding assistants and agents · Guide	CWE-829 CWE-250 CWE-1357 CWE-1427	A03:2025 A08:2025	—	V15	LLM01:2026 LLM02:2026 LLM03:2026 LLM04:2026 LLM07:2026 LLM10:2026 ASI04:2026 ASI05:2026 ASI01:2026 ASI02:2026 ASI03:2026 ASI09:2026	—	—
Write testable security requirements and a security Definition of Done · Guide	—	—	—	V2 V6 V8 V16	—	Derived: PO.1.2 PW.1.2	—
Abuse case library: tests and controls by feature · Guide	CWE-22 CWE-204 CWE-307 CWE-345 CWE-362 CWE-434 CWE-639 CWE-640 CWE-841 CWE-862 CWE-915 CWE-918 CWE-1236 CWE-1427	A01:2025 A06:2025 A07:2025 Derived: A08:2025	API1:2023 API5:2023 API6:2023 API7:2023	—	LLM01:2026 LLM03:2026	—	—
Threat pattern library for threat modeling · Guide	CWE-89 CWE-290 CWE-294 CWE-367 CWE-436 CWE-441 CWE-502 CWE-532 CWE-639 CWE-770 CWE-829 CWE-863 CWE-915 CWE-918 CWE-1427	A01:2025 A06:2025 Derived: A05:2025 A07:2025 A08:2025 A09:2025	—	—	—	—	—
Apply CISA Secure by Design: principles, pledge goals and evidence · Guide	CWE-78 CWE-79 CWE-89 CWE-798 CWE-1392	Derived: A05:2025 A07:2025	—	—	—	—	—
BSIMM vs SAMM vs SSDF: what each is for and which to use · Guide	—	—	—	—	—	Derived: PO.2.2 PW.1.2 RV.2.1 RV.3.3	—
Run a developer security training program that changes code · Guide	—	—	—	—	—	Derived: PO.2.2	—
Set up a PSIRT: services, intake, triage, SLAs and the CNA role · Guide	—	—	—	—	—	Derived: RV.1.3	—
Publish security advisories with CSAF, VEX, CVE records and OSV · Guide	CWE-306 CWE-347	Derived: A04:2025 A07:2025	—	—	—	—	—
Respond to product security incidents: plan, tabletop and postmortem · Guide	—	—	—	—	—	—	—
Build an application security career: roles, skills, portfolio and certifications · Guide	—	—	—	—	—	—	—
SOC 2 for engineering teams: CC6, CC7 and CC8 controls and the evidence auditors test · Guide	—	—	—	—	—	—	—
ISO 27001 secure development: Annex A 8.25 to 8.33 as engineering practice and evidence · Guide	—	—	—	—	—	—	—
NIST CSF 2.0 for product teams: the outcomes you own and the evidence for them · Guide	—	—	—	—	—	Derived: PO.1.1 PO.1.2 PO.1.3 PO.5.1	—
GDPR privacy by design for engineers: Articles 25, 32 and 35 in code · Guide	—	—	—	V14	—	—	MASVS-PRIVACY-1 MASVS-PRIVACY-4
NIS2 and DORA for software suppliers: what reaches you and the evidence to keep · Guide	—	—	—	—	—	—	—
UK Software Security Code of Practice: the 14 principles as engineering practice · Guide	—	—	—	—	—	Derived: PO.1 PO.3.2 PO.5 PO.5.1 PS.1.1 PS.2.1 PS.3.1 PS.3.2 PW.1 PW.4.1 PW.4.4 PW.7 PW.8 PW.9 RV.1.1 RV.1.3 RV.2 RV.2.2 RV.3	—
Regulated product security lifecycles: IEC 62443-4-1, FDA 524B, ISO/SAE 21434 and UN R155/R156 · Guide	—	—	—	—	—	—	—
Compliance evidence reuse: one evidence set for SSDF, PCI DSS, ISO 27001, SOC 2 and the CRA · Guide	—	—	—	—	—	Derived: PS.2.1 PS.3.1 PS.3.2 PW.7.2 PW.8.2 RV.1 RV.1.2 RV.2 RV.3	—
Answer a US federal secure software attestation request in 2026: the CISA form, its SSDF mapping and the evidence behind each statement · Guide	—	—	—	—	—	Derived: PO.1.1 PO.1.3 PO.3.1 PO.3.2 PO.3.3 PO.4 PO.4.1 PO.4.2 PO.5.1 PO.5.2 PS.1.1 PS.2.1 PS.3.1 PS.3.2 PW.2.1 PW.4.1 PW.4.4 PW.5.1 PW.6.1 PW.6.2 PW.7.1 PW.7.2 PW.8.1 PW.8.2 PW.9.1 PW.9.2 RV.1.1 RV.1.2 RV.1.3 RV.2.1 RV.2.2 RV.3.3	—
Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS · Guide	CWE-312 CWE-522 CWE-732 CWE-798	A02:2025 A04:2025 Derived: A01:2025 A06:2025 A07:2025	—	V13.2.1 V13.3.1 V13.3.2 V13.3.4	—	—	K03:2025 K02:2025
Case study: the LastPass breach (2022) · Guide	CWE-311 CWE-522 CWE-916 CWE-1104	A02:2025 A04:2025 A07:2025 Derived: A03:2025 A06:2025	—	V11.4.2 V13.3.1 V13.3.2 V14.2.4	—	—	—
Case study: the Okta support-system breach and session tokens in HAR files (2023) · Guide	CWE-294 CWE-522 CWE-532 CWE-613 CWE-778	A02:2025 A07:2025 A09:2025 Derived: A06:2025	—	V7.4.1 V7.4.2 V7.5.1 V16.2.1	—	—	—
Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot · Guide	CWE-295 CWE-298 CWE-324 CWE-778	A02:2025 A04:2025 A09:2025 Derived: A07:2025	—	V12.1.1 V12.2.2 V13.3.4	—	—	—
Prevent file inclusion: LFI, RFI, dynamic imports and template names · Guide	CWE-22 CWE-73 CWE-94 CWE-98 CWE-829	A05:2025 A01:2025 Derived: A06:2025 A08:2025	—	V1.3.2 V1.3.7 V5.3.1 V5.3.2	—	—	—
Create temporary files safely: mkstemp, O_EXCL and private directories · Guide	CWE-59 CWE-367 CWE-377 CWE-379	A01:2025	—	V5.3.2 V15.4 V15.4.2	—	—	—
Consume third-party APIs safely (OWASP API10:2023) · Guide	CWE-20 CWE-295 CWE-522 CWE-601 CWE-770	A03:2025 A05:2025 Derived: A01:2025 A06:2025 A07:2025	API10:2023 API7:2023	V1.3.6 V5.4.1 V13.1.1	—	—	—
Secure design patterns: a catalogue for insecure-design (A06) · Guide	CWE-636 CWE-657 CWE-862 CWE-863 CWE-1188	A06:2025 A01:2025 Derived: A10:2025	—	V1.2 V1.3	—	—	—
Worked threat model: a mobile banking app · Guide	CWE-295 CWE-308 CWE-319 CWE-862 CWE-922 CWE-926	A06:2025 Derived: A01:2025 A04:2025 A07:2025 A08:2025	API1:2023 API2:2023 API6:2023	—	—	—	MASVS-AUTH-1 MASVS-AUTH-3 MASVS-NETWORK-1 MASVS-NETWORK-2 MASVS-PLATFORM-3 MASVS-RESILIENCE-1 MASVS-STORAGE-1 MASVS-AUTH-2 MASVS-CRYPTO-1 MASVS-PLATFORM-1
Worked threat model: an LLM agent with tools · Guide	CWE-79 CWE-862 CWE-918 CWE-1427	A06:2025 Derived: A01:2025 A05:2025	—	—	LLM01:2026 LLM02:2026 LLM03:2026 LLM06:2026 LLM09:2026 LLM10:2026 ASI01:2026 ASI02:2026 ASI03:2026 ASI04:2026 ASI06:2026	—	—
Contain LLM misinformation (OWASP LLM07:2026) · Guide	CWE-1426	—	—	—	LLM07:2026 LLM10:2026 LLM04:2026 ASI09:2026 ASI06:2026	—	—
Call a hosted LLM API safely · Guide	CWE-359 CWE-522 CWE-532 CWE-770 CWE-798	A07:2025 A09:2025 Derived: A01:2025 A06:2025	—	V1.3.6 V13.1.1	LLM02:2026 LLM06:2026 LLM10:2026	—	—
DeFi attack patterns: oracles, flash loans, proxies and signatures · Guide	CWE-294 CWE-347 CWE-665 CWE-682	Derived: A04:2025 A07:2025	—	—	—	—	—
Sandbox model-generated code and computer-use agents · Guide	CWE-94 CWE-250 CWE-653 CWE-770	Derived: A05:2025 A06:2025	—	V13.2.4 V15.2.2 V15.2.5	LLM03:2026 LLM10:2026 ASI05:2026 ASI01:2026 ASI09:2026	—	—
Keep secrets and controls out of hidden context (OWASP LLM08:2026) · Guide	CWE-497 CWE-656 CWE-798	Derived: A01:2025 A06:2025 A07:2025	—	V8.3.1 V13.3.1	LLM08:2026 LLM01:2026 LLM02:2026	—	—
Defend agent memory and context against poisoning (OWASP ASI06) · Guide	CWE-349 CWE-501 CWE-1427	Derived: A06:2025	—	V8.2.2 V14.2.7	LLM01:2026 LLM05:2026 LLM09:2026 ASI06:2026 ASI01:2026 ASI08:2026	—	—
Case study: Moffatt v. Air Canada, a chatbot that misstated the refund policy (2022-2024) · Guide	—	—	—	—	LLM07:2026 ASI09:2026	—	—
Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025) · Guide	CWE-78 CWE-506 CWE-829	A03:2025 A08:2025 Derived: A05:2025	—	—	LLM03:2026 ASI04:2026 ASI05:2026	—	—
Case study: the Amazon Q Developer extension compromise (2025) · Guide	CWE-506 CWE-522	A03:2025 A08:2025 Derived: A06:2025	—	—	LLM03:2026 ASI04:2026 ASI05:2026	—	—
Case study: Storm-0558 and the forged Microsoft tokens (2023) · Guide	CWE-324 CWE-347 CWE-778	A04:2025 A07:2025 A09:2025	—	V9.1.3 V11.1.1 V13.3.4 V16.3.2	—	Derived: PO.1.3 PO.5.1 PS.1.1 PW.4.4 PW.5.1 PW.8.2 RV.1.1 RV.3.1 RV.3.3	—
Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025) · Guide	CWE-94 CWE-306 CWE-653	A02:2025 A05:2025 Derived: A06:2025 A07:2025	—	—	—	Derived: PW.4.4 PW.5.1 PW.8.2 PW.9.1 RV.1.1 RV.2.2 RV.3.3	—
Case study: the CircleCI security incident (January 2023) · Guide	CWE-294 CWE-522 CWE-798	A04:2025 A07:2025 Derived: A06:2025	—	V13.2.1 V13.3.1	—	Derived: PO.5.1 PO.5.2 PS.1.1 RV.2.2	—
Case study: Microsoft AI researchers' over-permissive SAS token (2023) · Guide	CWE-732 CWE-798	A01:2025 A02:2025 Derived: A07:2025	—	V13.3.2 V13.3.4	—	Derived: PO.3.2 PO.5.1 PS.1.1 PW.9.1	—
Case study: First American's EaglePro document exposure (2019) · Guide	CWE-306 CWE-639	A01:2025 Derived: A07:2025	—	V8.2.2 V8.3.1	—	Derived: PO.2.1 PO.4.1 PW.1.1 PW.5.1 PW.8.2 RV.2.1 RV.2.2	—
Case study: Citrix Bleed (CVE-2023-4966) · Guide	CWE-119 CWE-613	A07:2025	—	V7.4.5	—	Derived: PO.1.3 PW.5.1 PW.6.2 PW.8.2 RV.2.2 RV.3.3	—
Case study: Spring4Shell (CVE-2022-22965) · Guide	CWE-94 CWE-915	A03:2025 A05:2025 Derived: A08:2025	—	—	—	Derived: PS.3.2 PW.1.1 PW.4.1 PW.4.4 PW.5.1 PW.7.2 RV.2.1 RV.2.2 RV.3.3	—
Case study: CrowdStrike Channel File 291 (July 2024) · Guide	CWE-125 CWE-129	A10:2025 Derived: A05:2025	—	—	—	Derived: PO.4.1 PW.5.1 PW.8.2 RV.3.3 RV.3.4	—
Staged rollout and rollback for security-critical updates · Guide	—	—	—	—	—	Derived: PO.4.1 PS.2.1 PS.3.1 PW.8.2 RV.3.3 RV.3.4	—
Clickjacking · Fix card	CWE-1021	A06:2025	—	V3.4.6	—	—	—
Code injection · Fix card	CWE-94 CWE-95	A05:2025	—	V1.3.2	—	—	—
OS command and argument injection · Fix card	CWE-78 CWE-88	A05:2025	—	—	—	—	—
CORS misconfiguration on credentialed APIs · Fix card	CWE-346 CWE-942	A02:2025 A07:2025	—	V3.4.2 V3.5.2	—	—	—
CRLF injection in logs and response headers · Fix card	CWE-93 CWE-113 CWE-117	A05:2025 A09:2025	—	V1.2.1 V1.3.3 V16.4.1	—	—	—
Cross-site request forgery (CSRF) · Fix card	CWE-352	A01:2025	—	V3.3.2 V3.5.1 V3.5.3	—	—	—
CSV formula injection · Fix card	CWE-74 CWE-1236	A05:2025	—	V1.2.10	—	—	—
Insecure deserialization · Fix card	CWE-502	A08:2025	—	—	—	—	—
Unrestricted file upload · Fix card	CWE-73 CWE-434 CWE-646 CWE-770	A06:2025	—	V3.2.1 V3.4.4 V5.2.1 V5.2.2 V5.3.1 V5.3.2 V5.4.1	—	—	—
Hard-coded secrets · Fix card	CWE-260 CWE-261 CWE-798	A02:2025 A04:2025 A07:2025	—	V13.3.1 V14.2.1 V16.2.5 V16.5.1	—	—	—
Insecure randomness for security tokens · Fix card	CWE-330 CWE-338	A04:2025	—	V11.5.1 V11.5.2	—	—	—
JWT validation in APIs (bearer tokens) · Fix card	CWE-287 CWE-347	A04:2025 A07:2025	—	V9.1.1 V9.1.2 V9.1.3 V9.2.1 V9.2.3 V10.3.1 V10.3.3	—	—	—
LDAP filter injection · Fix card	CWE-90	A05:2025	—	V1.2.6	—	—	—
Mass assignment (over-posting) · Fix card	CWE-915	A08:2025	API3:2023	V8.2.3 V15.3.3	—	—	—
Missing authentication for a critical function · Fix card	CWE-287 CWE-288 CWE-290 CWE-306	A07:2025	API2:2023	V6.3.4 V8.3.1 V13.2.1	—	—	—
Missing object-level authorization (IDOR and BOLA) · Fix card	CWE-639 CWE-862 CWE-863	A01:2025	API1:2023	—	—	—	—
NoSQL operator injection · Fix card	CWE-943	A05:2025	—	V1.2.4 V15.3.5	—	—	—
Open redirect · Fix card	CWE-601	A01:2025	—	V3.7.2	—	—	—
Weak password hashing · Fix card	CWE-327 CWE-759 CWE-916	A04:2025	—	—	—	—	—
Path traversal · Fix card	CWE-22 CWE-23 CWE-36 CWE-59	A01:2025	—	—	—	—	—
Regular-expression denial of service (ReDoS) · Fix card	CWE-1333	A06:2025	—	—	—	—	—
Unbounded resource consumption · Fix card	CWE-400 CWE-770	A06:2025	API4:2023	V2.4.1 V15.2.2	—	—	—
Session fixation and session cookies · Fix card	CWE-384 CWE-613 CWE-614 CWE-1004 CWE-1275	A01:2025 A02:2025 A07:2025	—	V3.3.1 V3.3.2 V3.3.3 V3.3.4 V7.2.4 V7.3.1 V7.3.2	—	—	—
SQL injection · Fix card	CWE-89	A05:2025	—	—	—	—	—
Server-side request forgery (SSRF) · Fix card	CWE-918	A01:2025	—	—	—	—	—
Server-side template injection · Fix card	CWE-94 CWE-95 CWE-1336	A05:2025	—	—	—	—	—
Improper TLS certificate validation · Fix card	CWE-295 CWE-296 CWE-297	A04:2025 A07:2025	—	V12.3.2 V12.3.4	—	—	—
XPath injection · Fix card	CWE-91 CWE-643	A05:2025	—	V1.2.7	—	—	—
Cross-site scripting (XSS) · Fix card	CWE-79	A05:2025	—	—	—	—	—
XML external entity (XXE) processing · Fix card	CWE-611 CWE-776	A02:2025	—	—	—	—	—
CSRF lab: Protect an account change from a forged request · Lab	CWE-352	A01:2025	—	—	—	—	—
Path traversal lab: Keep archive entries inside their extraction directory · Lab	CWE-22	A01:2025	—	—	—	—	—
Race condition lab: Repair a balance check that races · Lab	CWE-362 CWE-367	A06:2025	—	—	—	—	—
SBOM completeness lab: Find the dependencies missing from a release SBOM · Lab	CWE-1395	A03:2025	—	—	—	—	—
Signed artifact provenance lab: Reject a release from the wrong producer · Lab	CWE-345	A08:2025	—	—	—	—	—
Privileged container lab: Reject a privileged workload before deployment · Lab	CWE-250	A02:2025	—	—	—	—	—
JWT validation lab: Validate the purpose and audience of a token · Lab	CWE-287	A07:2025	API2:2023	—	—	—	—
Password reset token lab: Make a recovery credential single-use · Lab	CWE-640	A07:2025	—	—	—	—	—
RAG access control lab: Stop a retriever from returning another tenant’s documents · Lab	CWE-285	A01:2025	—	—	LLM02:2026 LLM09:2026	—	—
Excessive agency lab: Bind an agent’s action to the approved arguments · Lab	CWE-862	A01:2025	—	—	LLM03:2026 ASI02:2026	—	—
XSS lab: Render a model’s answer as text instead of active markup · Lab	CWE-79	A05:2025	—	—	LLM10:2026	—	—
Release evidence lab: Keep stale test evidence out of a release decision · Lab	CWE-345	A08:2025	—	—	—	—	—
IDOR lab: Repair an invoice authorization bug · Lab	CWE-639	A01:2025	API1:2023	—	—	—	—
AES-GCM nonce reuse lab: Fix a nonce allocator that breaks after restart · Lab	CWE-323	A04:2025	—	—	—	—	—
Webhook signature and replay lab: Repair a webhook handler that pays twice · Lab	CWE-294 CWE-345	A07:2025 A08:2025	—	—	—	—	—
SSRF lab: Guard an outbound fetch against SSRF · Lab	CWE-918	A06:2025 Derived: A01:2025	API7:2023	—	—	—	—
CORS policy lab: Grant CORS to the right origins only · Lab	CWE-942	A01:2025 A02:2025	—	—	—	—	—
CSP builder lab: Build a strict Content-Security-Policy · Lab	CWE-1021	A02:2025 A05:2025 Derived: A06:2025	—	—	—	—	—
HTML sanitization lab: Configure a sanitizer for user comments · Lab	CWE-79	A05:2025	—	—	—	—	—
JWT verification lab: Verify a JWT before trusting it · Lab	CWE-347	A07:2025 Derived: A04:2025	API2:2023	—	—	—	—
Actions injection lab: Flag GitHub Actions expression injection · Lab	CWE-78 CWE-94	A03:2025 Derived: A05:2025	—	—	—	—	—
Business logic lab: Price an order without trusting the client · Lab	CWE-472 CWE-837 CWE-1284	A06:2025	API6:2023	—	—	—	—
SQL injection lab: Separate SQL structure from data with sqlite3 · Lab	CWE-89	A05:2025	API8:2023	—	—	—	—
Path traversal lab: Serve an uploaded file without path traversal · Lab	CWE-22	A01:2025	—	—	—	—	—
SSRF validation lab: Validate a fetch URL with ipaddress · Lab	CWE-918	A06:2025 Derived: A01:2025	API7:2023	—	—	—	—
Open redirect lab: Return users to this site only · Lab	CWE-601	A01:2025	—	—	—	—	—
File upload lab: Accept avatars without publishing pages · Lab	CWE-73 CWE-434 CWE-646 CWE-770	A06:2025	API4:2023	—	—	—	—
OS command injection lab: Run git without a shell · Lab	CWE-78 CWE-88	A05:2025	—	—	—	—	—
Mass assignment lab: Update only the fields users may edit · Lab	CWE-915	A08:2025	API3:2023	—	—	—	—
OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE · Lab	CWE-287 CWE-601	A01:2025 A07:2025	API2:2023	—	—	—	—
NetworkPolicy lab: Lock down a shop namespace · Lab	CWE-284 CWE-668	A01:2025 A02:2025	—	—	—	—	—
Insecure randomness lab: Generate unguessable API keys · Lab	CWE-330 CWE-331 CWE-338	A04:2025	—	—	—	—	—
Buffer over-read lab: Stop a heartbeat over-read · Lab	CWE-125 CWE-130	A10:2025	—	—	—	—	—
SSTI lab: Render a welcome banner without template injection · Lab	CWE-94 CWE-95 CWE-1336	A05:2025	—	—	—	—	—
XXE lab: Parse an uploaded invoice without resolving external entities · Lab	CWE-611 CWE-776	A02:2025	—	—	—	—	—
Pickle deserialization lab: Load a session token without pickle · Lab	CWE-502	A08:2025	—	—	—	—	—
Password hashing lab: Verify and upgrade an Argon2 password hash on login · Lab	CWE-327 CWE-759 CWE-916	A04:2025 A07:2025	—	—	—	—	—
IAM trust policy lab: Evaluate a role trust policy against the confused deputy · Lab	CWE-284 CWE-863	A01:2025 A02:2025	—	—	—	—	—

How the mappings are made

Bold: the identifier is the item’s main subject, as recorded on the identifier’s page.
Plain: the item covers the identifier in a dedicated section, or lists it in its own metadata.
Muted: derived. An OWASP Top 10:2025 category is derived when OWASP’s official CWE mapping for it lists one of the item’s CWEs; an SSDF 1.1 practice or task is derived when the guide names it in its text.

The JSON export names the relation of every mapping (primary, related, cites, via-cwe or mentions) and the CWE a derived category comes from. Editions: CWE 4.20, OWASP Top 10 2025, OWASP API Security Top 10 2023, OWASP ASVS 5.0.0, OWASP Top 10 for LLM Applications 2026, OWASP Top 10 for Agentic Applications 2026, NIST SSDF 1.1, OWASP MASVS 2.1.0, OWASP Kubernetes Top 10 2025. Mappings say where this site covers an identifier; they do not claim that the identifier’s requirements are fully met.

See also the standards directory, the identifier pages such as CWE and ASVS 5.0, and the coverage map.