Skip to content

OWASP ASVS Library

Use the configured OWASP ASVS 5.0.0 library to map web application findings, evidence, remediation, and retests to canonical requirements.

The OWASP Application Security Verification Standard is an open application-security standard that provides a basis for testing technical security controls and a requirements list for secure development. voiqq uses a canonical ASVS 5.0.0 system library rather than treating scanner alert names as the standard itself.

Standards and scope

ASVS requirements are organized into chapters and verification levels. Project scope should select the requirements appropriate to the application's risk and engagement objectives; a mapping should identify the most specific requirement supported by the evidence.

  • Verification levels provide increasing depth and assurance rather than simple vulnerability severity tiers.
  • Requirements address architecture, authentication, sessions, access control, validation, cryptography, data protection, communication, business logic, files, APIs, configuration, and related areas.
  • CWE or CVE references can provide context but do not replace the ASVS requirement mapping.
  • ZAP alert data is normalized as a candidate and must be professionally validated.
  • Retest evidence and validation state record whether the implemented control now meets the assessed requirement.

Who this is for

  • Security students and educators teaching verification requirements alongside vulnerability testing.
  • Application-security professionals and penetration testers producing repeatable findings.
  • Engineering teams adopting ASVS as a secure-development or release-review baseline.
  • Consultancies, public bodies, and organizations requiring a recognizable web security framework.

What voiqq provides

  • Canonical ASVS identifiers, titles, descriptions, levels, and references.
  • Project metrics that define verification scope without changing the system library.
  • Accurate background mapping for imported fields while preserving visible project data.
  • Finding evidence, status, ownership, remediation, validation, and history.
  • ASVS-aligned professional assessment reports generated from reviewed records.

A practical workflow

  1. Select the verification target and define the authorized application scope.
  2. Test the applicable control and capture concise reproducible evidence.
  3. Map the result to the most specific ASVS requirement rather than only its chapter.
  4. Review severity and remediation with technical and business context.
  5. Retest, validate, and approve the report snapshot.

Put the framework into practice

The ASVS library gives learners, reviewers, and development teams a common requirements vocabulary while voiqq supplies the operational workflow around each result.

Start free

Read the OWASP ASVS project page

voiqq uses the official OWASP ASVS 5.0.0 catalogue: 345 individual verification requirements across 17 chapters. A finding can be linked to the relevant requirement, while the report summarizes coverage by chapter instead of dumping every requirement into the report.