Files

 main

/

cres

/

Copy path

Directory actions

More options

Directory actions

More options

Latest commit

northdpole

Fix hierarchy jumps (OWASP#74)

Sep 16, 2021

61c3882 · Sep 16, 2021

History

History

This branch is 345 commits behind OWASP/OpenCRE:main.

/

cres

/

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
old		old	Full text search (OWASP#37)	Sep 7, 2021
'__Host' prefix for cookie-based session tokens.yaml		'__Host' prefix for cookie-based session tokens.yaml	new-data (OWASP#35)	Sep 4, 2021
API-web services.yaml		API-web services.yaml	new-data (OWASP#35)	Sep 4, 2021
Biometric autheticators only as seconday factors.yaml		Biometric autheticators only as seconday factors.yaml	new-data (OWASP#35)	Sep 4, 2021
Access control fail-safe.yaml		Access control fail-safe.yaml	new-data (OWASP#35)	Sep 4, 2021
Access control on trusted service layer.yaml		Access control on trusted service layer.yaml	new-data (OWASP#35)	Sep 4, 2021
Accessible password changing functionality.yaml		Accessible password changing functionality.yaml	new-data (OWASP#35)	Sep 4, 2021
Accompany OAuth with Referesh tokens.yaml		Accompany OAuth with Referesh tokens.yaml	new-data (OWASP#35)	Sep 4, 2021
Additional authorization for lower and higher value application.yaml		Additional authorization for lower and higher value application.yaml	new-data (OWASP#35)	Sep 4, 2021
Admin only access to management funcitonality.yaml		Admin only access to management funcitonality.yaml	new-data (OWASP#35)	Sep 4, 2021
Admnistrative interfaces use appropriate multi-factor.yaml		Admnistrative interfaces use appropriate multi-factor.yaml	new-data (OWASP#35)	Sep 4, 2021
All components authenticated and with least privileges.yaml		All components authenticated and with least privileges.yaml	new-data (OWASP#35)	Sep 4, 2021
All random elements are generated using approved cryptographic secure randum numbers if intention is not to be guessable.yaml		All random elements are generated using approved cryptographic secure randum numbers if intention is not to be guessable.yaml	new-data (OWASP#35)	Sep 4, 2021
All sensitive data classified in protection levels.yaml		All sensitive data classified in protection levels.yaml	new-data (OWASP#35)	Sep 4, 2021
Allow password helpers, including paste.yaml		Allow password helpers, including paste.yaml	new-data (OWASP#35)	Sep 4, 2021
Allow user to delete or access their data.yaml		Allow user to delete or access their data.yaml	new-data (OWASP#35)	Sep 4, 2021
Anti-Automation protection for REST services.yaml		Anti-Automation protection for REST services.yaml	new-data (OWASP#35)	Sep 4, 2021
Anti-automation control.yaml		Anti-automation control.yaml	new-data (OWASP#35)	Sep 4, 2021
Approved cryptographic algorithms for generation, seeding and verification.yaml		Approved cryptographic algorithms for generation, seeding and verification.yaml	new-data (OWASP#35)	Sep 4, 2021
Approved cryptographic algorithms in generation, seeding and verification.yaml		Approved cryptographic algorithms in generation, seeding and verification.yaml	new-data (OWASP#35)	Sep 4, 2021
Approved cryptographic algorithms.yaml		Approved cryptographic algorithms.yaml	new-data (OWASP#35)	Sep 4, 2021
Attain user consent when using their data.yaml		Attain user consent when using their data.yaml	new-data (OWASP#35)	Sep 4, 2021
Autenticate encrypted data for integrity.yaml		Autenticate encrypted data for integrity.yaml	new-data (OWASP#35)	Sep 4, 2021
Authenticate HTTP headers added by a trusted proxy or SSO device.yaml		Authenticate HTTP headers added by a trusted proxy or SSO device.yaml	new-data (OWASP#35)	Sep 4, 2021
Authenticate all extenrnal connections.yaml		Authenticate all extenrnal connections.yaml	new-data (OWASP#35)	Sep 4, 2021
Authenticate by OTP token entry or user-initiated action on multi factor device.yaml		Authenticate by OTP token entry or user-initiated action on multi factor device.yaml	new-data (OWASP#35)	Sep 4, 2021
Authenticate consistently.yaml		Authenticate consistently.yaml	new-data (OWASP#35)	Sep 4, 2021
Authentication mechanism.yaml		Authentication mechanism.yaml	new-data (OWASP#35)	Sep 4, 2021
Authentication secrets sent encrypted to the user.yaml		Authentication secrets sent encrypted to the user.yaml	new-data (OWASP#35)	Sep 4, 2021
Authentication timeout.yaml		Authentication timeout.yaml	new-data (OWASP#35)	Sep 4, 2021
Authentication.yaml		Authentication.yaml	new-data (OWASP#35)	Sep 4, 2021
Authorized access.yaml		Authorized access.yaml	new-data (OWASP#35)	Sep 4, 2021
Automatic verification of deployment procedure.yaml		Automatic verification of deployment procedure.yaml	new-data (OWASP#35)	Sep 4, 2021
Availability of secure coding resources for programmers.yaml		Availability of secure coding resources for programmers.yaml	new-data (OWASP#35)	Sep 4, 2021
Avoid using of Origin header for authentication of access control.yaml		Avoid using of Origin header for authentication of access control.yaml	new-data (OWASP#35)	Sep 4, 2021
Avoide usage of untrusted file metadata.yaml		Avoide usage of untrusted file metadata.yaml	new-data (OWASP#35)	Sep 4, 2021
Backups.yaml		Backups.yaml	new-data (OWASP#35)	Sep 4, 2021
Binary integrity.yaml		Binary integrity.yaml	new-data (OWASP#35)	Sep 4, 2021
Boundary Protection.yaml		Boundary Protection.yaml	new-data (OWASP#35)	Sep 4, 2021
Business logic.yaml		Business logic.yaml	new-data (OWASP#35)	Sep 4, 2021
CSRF protection against authenticated and un-authenticated functionality.yaml		CSRF protection against authenticated and un-authenticated functionality.yaml	new-data (OWASP#35)	Sep 4, 2021
CSRF protection for cookie based RESTful web services.yaml		CSRF protection for cookie based RESTful web services.yaml	new-data (OWASP#35)	Sep 4, 2021
Centralized secure security controls.yaml		Centralized secure security controls.yaml	new-data (OWASP#35)	Sep 4, 2021
Challenge nonce is of sufficient size and sufficiently unique.yaml		Challenge nonce is of sufficient size and sufficiently unique.yaml	new-data (OWASP#35)	Sep 4, 2021
Change password with presence of old and new password.yaml		Change password with presence of old and new password.yaml	new-data (OWASP#35)	Sep 4, 2021
Changeability after cryptographic break.yaml		Changeability after cryptographic break.yaml	new-data (OWASP#35)	Sep 4, 2021
Check for zip bombs.yaml		Check for zip bombs.yaml	new-data (OWASP#35)	Sep 4, 2021
Check incomming file size.yaml		Check incomming file size.yaml	new-data (OWASP#35)	Sep 4, 2021
Check registration passwords against breached passwords.yaml		Check registration passwords against breached passwords.yaml	new-data (OWASP#35)	Sep 4, 2021
Clear and Justified trust boundries.yaml		Clear and Justified trust boundries.yaml	new-data (OWASP#35)	Sep 4, 2021
Clear and justified security analysis of High-level architecture and remote servises.yaml		Clear and justified security analysis of High-level architecture and remote servises.yaml	new-data (OWASP#35)	Sep 4, 2021
Clear policy complient I-O requirements .yaml		Clear policy complient I-O requirements .yaml	new-data (OWASP#35)	Sep 4, 2021
Common logging format.yaml		Common logging format.yaml	new-data (OWASP#35)	Sep 4, 2021
Communication authentication.yaml		Communication authentication.yaml	new-data (OWASP#35)	Sep 4, 2021
Communication encryption.yaml		Communication encryption.yaml	new-data (OWASP#35)	Sep 4, 2021
Configurable alert against anomalies.yaml		Configurable alert against anomalies.yaml	new-data (OWASP#35)	Sep 4, 2021
Configuration.yaml		Configuration.yaml	new-data (OWASP#35)	Sep 4, 2021
Consistent authentication strength.yaml		Consistent authentication strength.yaml	new-data (OWASP#35)	Sep 4, 2021
Constant-validated format strings.yaml		Constant-validated format strings.yaml	new-data (OWASP#35)	Sep 4, 2021
Constrain functional features based on user stories.yaml		Constrain functional features based on user stories.yaml	new-data (OWASP#35)	Sep 4, 2021
Content-Disposition for API responses .yaml		Content-Disposition for API responses .yaml	new-data (OWASP#35)	Sep 4, 2021
Content-type verification for REST sevises .yaml		Content-type verification for REST sevises .yaml	new-data (OWASP#35)	Sep 4, 2021
Context-specific output encoding against SQL injection.yaml		Context-specific output encoding against SQL injection.yaml	new-data (OWASP#35)	Sep 4, 2021
Control outdated-insecure componencts.yaml		Control outdated-insecure componencts.yaml	new-data (OWASP#35)	Sep 4, 2021
Cookie-config.yaml		Cookie-config.yaml	new-data (OWASP#35)	Sep 4, 2021
Credential recovery.yaml		Credential recovery.yaml	new-data (OWASP#35)	Sep 4, 2021
Credentials directives.yaml		Credentials directives.yaml	new-data (OWASP#35)	Sep 4, 2021
Cryptographic authentication software and devices.yaml		Cryptographic authentication software and devices.yaml	new-data (OWASP#35)	Sep 4, 2021
Cryptographic configuration state of the art.yaml		Cryptographic configuration state of the art.yaml	new-data (OWASP#35)	Sep 4, 2021
Cryptographic modules fail securely.yaml		Cryptographic modules fail securely.yaml	new-data (OWASP#35)	Sep 4, 2021
Cryptographically secure session tockens.yaml		Cryptographically secure session tockens.yaml	new-data (OWASP#35)	Sep 4, 2021
Cryptographically secure stateless tokens.yaml		Cryptographically secure stateless tokens.yaml	new-data (OWASP#35)	Sep 4, 2021
Cryptography.yaml		Cryptography.yaml	new-data (OWASP#35)	Sep 4, 2021
DOS.yaml		DOS.yaml	new-data (OWASP#35)	Sep 4, 2021
Data access control mechanism.yaml		Data access control mechanism.yaml	new-data (OWASP#35)	Sep 4, 2021
Data access control.yaml		Data access control.yaml	new-data (OWASP#35)	Sep 4, 2021
Data security requirement documentation.yaml		Data security requirement documentation.yaml	new-data (OWASP#35)	Sep 4, 2021
Dead code removal.yaml		Dead code removal.yaml	new-data (OWASP#35)	Sep 4, 2021
Dedicated secrets management solution is used.yaml		Dedicated secrets management solution is used.yaml	new-data (OWASP#35)	Sep 4, 2021
Deny by default for new users.yaml		Deny by default for new users.yaml	new-data (OWASP#35)	Sep 4, 2021
Dependency strength.yaml		Dependency strength.yaml	new-data (OWASP#35)	Sep 4, 2021
Deployed topology.yaml		Deployed topology.yaml	new-data (OWASP#35)	Sep 4, 2021
Deployment process.yaml		Deployment process.yaml	new-data (OWASP#35)	Sep 4, 2021
Deployment.yaml		Deployment.yaml	new-data (OWASP#35)	Sep 4, 2021
Deserialization Prevention .yaml		Deserialization Prevention .yaml	new-data (OWASP#35)	Sep 4, 2021
Deserialization Prevention.yaml		Deserialization Prevention.yaml	new-data (OWASP#35)	Sep 4, 2021
Deserialization of untrusted communication.yaml		Deserialization of untrusted communication.yaml	new-data (OWASP#35)	Sep 4, 2021
Developer Configuration Management.yaml		Developer Configuration Management.yaml	new-data (OWASP#35)	Sep 4, 2021
Developer Testing and Evaluation.yaml		Developer Testing and Evaluation.yaml	new-data (OWASP#35)	Sep 4, 2021
Development & operations.yaml		Development & operations.yaml	new-data (OWASP#35)	Sep 4, 2021
Development verification.yaml		Development verification.yaml	new-data (OWASP#35)	Sep 4, 2021
Disable debug mode in production.yaml		Disable debug mode in production.yaml	new-data (OWASP#35)	Sep 4, 2021
Disable insecure SSL-TLS versions.yaml		Disable insecure SSL-TLS versions.yaml	new-data (OWASP#35)	Sep 4, 2021
Do not store secrets in the code.yaml		Do not store secrets in the code.yaml	new-data (OWASP#35)	Sep 4, 2021
Do not store sensitive data on client storage.yaml		Do not store sensitive data on client storage.yaml	new-data (OWASP#35)	Sep 4, 2021
Do not use user-submitted filename metadata directy.yaml		Do not use user-submitted filename metadata directy.yaml	new-data (OWASP#35)	Sep 4, 2021
Documentation and requirements.yaml		Documentation and requirements.yaml	new-data (OWASP#35)	Sep 4, 2021
Docuymentation of all components' business or security function.yaml		Docuymentation of all components' business or security function.yaml	new-data (OWASP#35)	Sep 4, 2021
Encode user input befor logging.yaml		Encode user input befor logging.yaml	new-data (OWASP#35)	Sep 4, 2021
Encrypt all communications.yaml		Encrypt all communications.yaml	new-data (OWASP#35)	Sep 4, 2021
Encrypt data at rest.yaml		Encrypt data at rest.yaml	new-data (OWASP#35)	Sep 4, 2021
Encrypt financial data at rest.yaml		Encrypt financial data at rest.yaml	new-data (OWASP#35)	Sep 4, 2021
Encrypt health data at rest.yaml		Encrypt health data at rest.yaml	new-data (OWASP#35)	Sep 4, 2021
Encrypt personal data at rest.yaml		Encrypt personal data at rest.yaml	new-data (OWASP#35)	Sep 4, 2021
Encrypt sensitive or private information.yaml		Encrypt sensitive or private information.yaml	new-data (OWASP#35)	Sep 4, 2021
Error handling.yaml		Error handling.yaml	new-data (OWASP#35)	Sep 4, 2021
Escape output against XSS.yaml		Escape output against XSS.yaml	new-data (OWASP#35)	Sep 4, 2021
Fail securely.yaml		Fail securely.yaml	new-data (OWASP#35)	Sep 4, 2021
File download.yaml		File download.yaml	new-data (OWASP#35)	Sep 4, 2021
File execution.yaml		File execution.yaml	new-data (OWASP#35)	Sep 4, 2021
File handling.yaml		File handling.yaml	new-data (OWASP#35)	Sep 4, 2021
File storage.yaml		File storage.yaml	new-data (OWASP#35)	Sep 4, 2021
File upload.yaml		File upload.yaml	new-data (OWASP#35)	Sep 4, 2021
Flexible access control solution.yaml		Flexible access control solution.yaml	new-data (OWASP#35)	Sep 4, 2021
Flow integrity on business logic .yaml		Flow integrity on business logic .yaml	new-data (OWASP#35)	Sep 4, 2021
Forgotten password, and other recovery paths use a secure recovery mechanism.yaml		Forgotten password, and other recovery paths use a secure recovery mechanism.yaml	new-data (OWASP#35)	Sep 4, 2021
Guidelines.yaml		Guidelines.yaml	new-data (OWASP#35)	Sep 4, 2021
HTTP security headers.yaml		HTTP security headers.yaml	new-data (OWASP#35)	Sep 4, 2021
High entropy session tokens.yaml		High entropy session tokens.yaml	new-data (OWASP#35)	Sep 4, 2021
Http headers.yaml		Http headers.yaml	new-data (OWASP#35)	Sep 4, 2021
Httponly attribute for cookie-based session tokens.yaml		Httponly attribute for cookie-based session tokens.yaml	new-data (OWASP#35)	Sep 4, 2021
Identify all sensitive data- have policy to deal with sensitive data.yaml		Identify all sensitive data- have policy to deal with sensitive data.yaml	new-data (OWASP#35)	Sep 4, 2021
If one-time password or factor in multi-factor is lost, authentication should be the same level as enrollment.yaml		If one-time password or factor in multi-factor is lost, authentication should be the same level as enrollment.yaml	new-data (OWASP#35)	Sep 4, 2021
If time-based one-time password is re-used while valid, log it and notify device holder.yaml		If time-based one-time password is re-used while valid, log it and notify device holder.yaml	new-data (OWASP#35)	Sep 4, 2021
In case PBKDF2, use as many iterations as feasible.yaml		In case PBKDF2, use as many iterations as feasible.yaml	new-data (OWASP#35)	Sep 4, 2021
In case bcrypt, set work factor as high as feasbile.yaml		In case bcrypt, set work factor as high as feasbile.yaml	new-data (OWASP#35)	Sep 4, 2021
Information used by access controls only editable by specifically authorized users.yaml		Information used by access controls only editable by specifically authorized users.yaml	new-data (OWASP#35)	Sep 4, 2021
Informing relying parties on CSP's last authentication event.yaml		Informing relying parties on CSP's last authentication event.yaml	new-data (OWASP#35)	Sep 4, 2021
Initial authentication code is generated by secure random numer, sufficient size and complexity.yaml		Initial authentication code is generated by secure random numer, sufficient size and complexity.yaml	new-data (OWASP#35)	Sep 4, 2021
Injection.yaml		Injection.yaml	new-data (OWASP#35)	Sep 4, 2021
Input and output verification.yaml		Input and output verification.yaml	new-data (OWASP#35)	Sep 4, 2021
Input validation on trusted service layer.yaml		Input validation on trusted service layer.yaml	new-data (OWASP#35)	Sep 4, 2021
Input validation.yaml		Input validation.yaml	new-data (OWASP#35)	Sep 4, 2021
Integrity check and encryption of serialized objects.yaml		Integrity check and encryption of serialized objects.yaml	new-data (OWASP#35)	Sep 4, 2021
Integrity check for message payload.yaml		Integrity check for message payload.yaml	new-data (OWASP#35)	Sep 4, 2021
Integrity check on all resources and code.yaml		Integrity check on all resources and code.yaml	new-data (OWASP#35)	Sep 4, 2021
Integrity check on deployment binaries.yaml		Integrity check on deployment binaries.yaml	new-data (OWASP#35)	Sep 4, 2021
Integrity ckeck for externally hosted assets.yaml		Integrity ckeck for externally hosted assets.yaml	new-data (OWASP#35)	Sep 4, 2021
Isolation of user uploaded files .yaml		Isolation of user uploaded files .yaml	new-data (OWASP#35)	Sep 4, 2021
Key material processed in dedicated solution for secrets, not in application.yaml		Key material processed in dedicated solution for secrets, not in application.yaml	new-data (OWASP#35)	Sep 4, 2021
Keys used to verify one-time passwords are highly protected.yaml		Keys used to verify one-time passwords are highly protected.yaml	new-data (OWASP#35)	Sep 4, 2021
Least privilage on all levels.yaml		Least privilage on all levels.yaml	new-data (OWASP#35)	Sep 4, 2021
Least privilege for resources.yaml		Least privilege for resources.yaml	new-data (OWASP#35)	Sep 4, 2021
Least privilege for system accounts of system components.yaml		Least privilege for system accounts of system components.yaml	new-data (OWASP#35)	Sep 4, 2021
Limit number of requests per user.yaml		Limit number of requests per user.yaml	new-data (OWASP#35)	Sep 4, 2021
Log access control decisions.yaml		Log access control decisions.yaml	new-data (OWASP#35)	Sep 4, 2021
Log all security relevant events.yaml		Log all security relevant events.yaml	new-data (OWASP#35)	Sep 4, 2021
Log authentication decisions.yaml		Log authentication decisions.yaml	new-data (OWASP#35)	Sep 4, 2021
Log discretely.yaml		Log discretely.yaml	new-data (OWASP#35)	Sep 4, 2021
Log integrity.yaml		Log integrity.yaml	new-data (OWASP#35)	Sep 4, 2021
Log out from all active session.yaml		Log out from all active session.yaml	new-data (OWASP#35)	Sep 4, 2021
Log relevant.yaml		Log relevant.yaml	new-data (OWASP#35)	Sep 4, 2021
Logg failed TLS connections.yaml		Logg failed TLS connections.yaml	new-data (OWASP#35)	Sep 4, 2021
Logging and error handling.yaml		Logging and error handling.yaml	new-data (OWASP#35)	Sep 4, 2021
Long passwords are allowed.yaml		Long passwords are allowed.yaml	new-data (OWASP#35)	Sep 4, 2021
Lookup secrets are unpredictable.yaml		Lookup secrets are unpredictable.yaml	new-data (OWASP#35)	Sep 4, 2021
Lookup secrets can be used only once.yaml		Lookup secrets can be used only once.yaml	new-data (OWASP#35)	Sep 4, 2021
Lookup secrets sufficiently random and salted plus hashed if short.yaml		Lookup secrets sufficiently random and salted plus hashed if short.yaml	new-data (OWASP#35)	Sep 4, 2021
MFA-OTP.yaml		MFA-OTP.yaml	new-data (OWASP#35)	Sep 4, 2021
Maintained inventory catalog for third party repositories.yaml		Maintained inventory catalog for third party repositories.yaml	new-data (OWASP#35)	Sep 4, 2021
Manage temporary storage.yaml		Manage temporary storage.yaml	new-data (OWASP#35)	Sep 4, 2021
Mandated use of multi factor authentication.yaml		Mandated use of multi factor authentication.yaml	new-data (OWASP#35)	Sep 4, 2021
Memory, String, and Unmanaged Code.yaml		Memory, String, and Unmanaged Code.yaml	new-data (OWASP#35)	Sep 4, 2021
Minimal permisions for application.yaml		Minimal permisions for application.yaml	new-data (OWASP#35)	Sep 4, 2021
Minimize the number of parameters in a request.yaml		Minimize the number of parameters in a request.yaml	new-data (OWASP#35)	Sep 4, 2021
Minimize.yaml		Minimize.yaml	new-data (OWASP#35)	Sep 4, 2021
Model-based authorization decisions at URI,controller, router, and resources.yaml		Model-based authorization decisions at URI,controller, router, and resources.yaml	new-data (OWASP#35)	Sep 4, 2021
Monitor unusual activities.yaml		Monitor unusual activities.yaml	new-data (OWASP#35)	Sep 4, 2021
Mutual authentication between credential service provider and application.yaml		Mutual authentication between credential service provider and application.yaml	new-data (OWASP#35)	Sep 4, 2021
Network level isolation of application deployment actions.yaml		Network level isolation of application deployment actions.yaml	new-data (OWASP#35)	Sep 4, 2021
New session tocken upon authentication.yaml		New session tocken upon authentication.yaml	new-data (OWASP#35)	Sep 4, 2021
No backdoors.yaml		No backdoors.yaml	new-data (OWASP#35)	Sep 4, 2021
No credentials or paymend details in logs.yaml		No credentials or paymend details in logs.yaml	new-data (OWASP#35)	Sep 4, 2021
No default accounts.yaml		No default accounts.yaml	new-data (OWASP#35)	Sep 4, 2021
No execution of untrusted files or functions.yaml		No execution of untrusted files or functions.yaml	new-data (OWASP#35)	Sep 4, 2021
No execution of uploaded files.yaml		No execution of uploaded files.yaml	new-data (OWASP#35)	Sep 4, 2021
No exposure of session tocken in URL or error message.yaml		No exposure of session tocken in URL or error message.yaml	new-data (OWASP#35)	Sep 4, 2021
No fall back to insecure protocols in TCP.yaml		No fall back to insecure protocols in TCP.yaml	new-data (OWASP#35)	Sep 4, 2021
No information disclosure through HTTP header or responce.yaml		No information disclosure through HTTP header or responce.yaml	new-data (OWASP#35)	Sep 4, 2021
No information disclosure through error message.yaml		No information disclosure through error message.yaml	new-data (OWASP#35)	Sep 4, 2021
No malicious code.yaml		No malicious code.yaml	new-data (OWASP#35)	Sep 4, 2021
No password hints or secret questions.yaml		No password hints or secret questions.yaml	new-data (OWASP#35)	Sep 4, 2021
No password rotation rules or history requirements.yaml		No password rotation rules or history requirements.yaml	new-data (OWASP#35)	Sep 4, 2021
No rules on type of characters in passwords.yaml		No rules on type of characters in passwords.yaml	new-data (OWASP#35)	Sep 4, 2021
No sensitive data exposure through error message.yaml		No sensitive data exposure through error message.yaml	new-data (OWASP#35)	Sep 4, 2021
No sensitive data in logs.yaml		No sensitive data in logs.yaml	new-data (OWASP#35)	Sep 4, 2021
No shared high privilage accounts.yaml		No shared high privilage accounts.yaml	new-data (OWASP#35)	Sep 4, 2021
No sharing of unsynchronized state on high-value logic flows.yaml		No sharing of unsynchronized state on high-value logic flows.yaml	new-data (OWASP#35)	Sep 4, 2021
No static secrets for session tockens.yaml		No static secrets for session tockens.yaml	new-data (OWASP#35)	Sep 4, 2021
No static secrets.yaml		No static secrets.yaml	new-data (OWASP#35)	Sep 4, 2021
No timebombs.yaml		No timebombs.yaml	new-data (OWASP#35)	Sep 4, 2021
No unauthorized client data collection .yaml		No unauthorized client data collection .yaml	new-data (OWASP#35)	Sep 4, 2021
No unhandeled exceptions.yaml		No unhandeled exceptions.yaml	new-data (OWASP#35)	Sep 4, 2021
No unsafe execution of unsanitized user input.yaml		No unsafe execution of unsanitized user input.yaml	new-data (OWASP#35)	Sep 4, 2021
No unsupported-insecure-depricated client-side technologies.yaml		No unsupported-insecure-depricated client-side technologies.yaml	new-data (OWASP#35)	Sep 4, 2021
No unwanted functiuonality.yaml		No unwanted functiuonality.yaml	new-data (OWASP#35)	Sep 4, 2021
Notify user about credential change.yaml		Notify user about credential change.yaml	new-data (OWASP#35)	Sep 4, 2021
Notify users about anomalies in their usage patterns.yaml		Notify users about anomalies in their usage patterns.yaml	new-data (OWASP#35)	Sep 4, 2021
One time passwords are securely random generated, long, complex, expire quick and not used after.yaml		One time passwords are securely random generated, long, complex, expire quick and not used after.yaml	new-data (OWASP#35)	Sep 4, 2021
Only a hashed version of authentication code is stored.yaml		Only a hashed version of authentication code is stored.yaml	new-data (OWASP#35)	Sep 4, 2021
Option to view entire password or the last typed character.yaml		Option to view entire password or the last typed character.yaml	new-data (OWASP#35)	Sep 4, 2021
Out of band authentication requests, codes or tokens are communicated securely and independently.yaml		Out of band authentication requests, codes or tokens are communicated securely and independently.yaml	new-data (OWASP#35)	Sep 4, 2021
Out of band authentication requests, codes or tokens expire.yaml		Out of band authentication requests, codes or tokens expire.yaml	new-data (OWASP#35)	Sep 4, 2021
Out of band authentication requests, codes or tokens usable only once.yaml		Out of band authentication requests, codes or tokens usable only once.yaml	new-data (OWASP#35)	Sep 4, 2021
Output encoding and injection prevention.yaml		Output encoding and injection prevention.yaml	new-data (OWASP#35)	Sep 4, 2021
Output encoding near the interpreter.yaml		Output encoding near the interpreter.yaml	new-data (OWASP#35)	Sep 4, 2021
Overwrite sensitive information with nonsense after expiry.yaml		Overwrite sensitive information with nonsense after expiry.yaml	new-data (OWASP#35)	Sep 4, 2021
Parsing and evaluating JSON.yaml		Parsing and evaluating JSON.yaml	new-data (OWASP#35)	Sep 4, 2021
Password recovery hides the current password.yaml		Password recovery hides the current password.yaml	new-data (OWASP#35)	Sep 4, 2021
Password storage salt is random and long.yaml		Password storage salt is random and long.yaml	new-data (OWASP#35)	Sep 4, 2021
Passwords may contain spaces.yaml		Passwords may contain spaces.yaml	new-data (OWASP#35)	Sep 4, 2021
Passwords may contain unicode.yaml		Passwords may contain unicode.yaml	new-data (OWASP#35)	Sep 4, 2021
Passwords salted and hashed.yaml		Passwords salted and hashed.yaml	new-data (OWASP#35)	Sep 4, 2021
Personal data handling.yaml		Personal data handling.yaml	new-data (OWASP#35)	Sep 4, 2021
Physical security.yaml		Physical security.yaml	new-data (OWASP#35)	Sep 4, 2021
Physical single factor one-time password generator can be revoked fully immediately when lost.yaml		Physical single factor one-time password generator can be revoked fully immediately when lost.yaml	new-data (OWASP#35)	Sep 4, 2021
Preserve user input format when encoding Unicode.yaml		Preserve user input format when encoding Unicode.yaml	new-data (OWASP#35)	Sep 4, 2021
Prevent security disclosure.yaml		Prevent security disclosure.yaml	new-data (OWASP#35)	Sep 4, 2021
Privilage control on RESTful method.yaml		Privilage control on RESTful method.yaml	new-data (OWASP#35)	Sep 4, 2021
Program Management.yaml		Program Management.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper CSP configuration.yaml		Proper CSP configuration.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper Configuration foe all applications and frameworks.yaml		Proper Configuration foe all applications and frameworks.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper HSTS configuration.yaml		Proper HSTS configuration.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper Referrer-Policy configuration.yaml		Proper Referrer-Policy configuration.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper Session timeout setting for CSP.yaml		Proper Session timeout setting for CSP.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper X-Content-Type-Options configuration.yaml		Proper X-Content-Type-Options configuration.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper X-Frame-Options for CSP conficuration.yaml		Proper X-Frame-Options for CSP conficuration.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper certificate trust chain.yaml		Proper certificate trust chain.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper execution of key derivation function, and secure storage of secret salt.yaml		Proper execution of key derivation function, and secure storage of secret salt.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper generation of secure randoms.yaml		Proper generation of secure randoms.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper implementation of datalayer authorization logic.yaml		Proper implementation of datalayer authorization logic.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper protection against GraphQL or data layer expression denial of service.yaml		Proper protection against GraphQL or data layer expression denial of service.yaml	new-data (OWASP#35)	Sep 4, 2021
Proper segrigation of components via security controls.yaml		Proper segrigation of components via security controls.yaml	new-data (OWASP#35)	Sep 4, 2021
Properly configured compiler flags.yaml		Properly configured compiler flags.yaml	new-data (OWASP#35)	Sep 4, 2021
Proteciton against integer overflows.yaml		Proteciton against integer overflows.yaml	new-data (OWASP#35)	Sep 4, 2021
Protect against Xpath injection.yaml		Protect against Xpath injection.yaml	new-data (OWASP#35)	Sep 4, 2021
Protect against mass parameter assignment attack.yaml		Protect against mass parameter assignment attack.yaml	new-data (OWASP#35)	Sep 4, 2021
Protect against server component caching of sensitive data.yaml		Protect against server component caching of sensitive data.yaml	new-data (OWASP#35)	Sep 4, 2021
Protect and purge temperory copied of sensitive data.yaml		Protect and purge temperory copied of sensitive data.yaml	new-data (OWASP#35)	Sep 4, 2021
Protect both headers and payload.yaml		Protect both headers and payload.yaml	new-data (OWASP#35)	Sep 4, 2021
Protect data in transit between components.yaml		Protect data in transit between components.yaml	new-data (OWASP#35)	Sep 4, 2021
Protect logs against log injection.yaml		Protect logs against log injection.yaml	new-data (OWASP#35)	Sep 4, 2021
Protect logs against unauthorized access .yaml		Protect logs against unauthorized access .yaml	new-data (OWASP#35)	Sep 4, 2021
Protected facilities for cryptographic secret storage.yaml		Protected facilities for cryptographic secret storage.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against DNS attacks.yaml		Protection against DNS attacks.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against JavaScript or JSON injection attacks.yaml		Protection against JavaScript or JSON injection attacks.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against LDAP injection.yaml		Protection against LDAP injection.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against LFI or RFI attacks.yaml		Protection against LFI or RFI attacks.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against SMTP it IMAP injection.yaml		Protection against SMTP it IMAP injection.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against SSRF attacks.yaml		Protection against SSRF attacks.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against directory discovery attacks.yaml		Protection against directory discovery attacks.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against identified risks.yaml		Protection against identified risks.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against race conditions.yaml		Protection against race conditions.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against template injection.yaml		Protection against template injection.yaml	new-data (OWASP#35)	Sep 4, 2021
Protection against unauthorized modification .yaml		Protection against unauthorized modification .yaml	new-data (OWASP#35)	Sep 4, 2021
Protection levels have requiements.yaml		Protection levels have requiements.yaml	new-data (OWASP#35)	Sep 4, 2021
Provide a password strength meter.yaml		Provide a password strength meter.yaml	new-data (OWASP#35)	Sep 4, 2021
Ptotect against HTTP polution attack.yaml		Ptotect against HTTP polution attack.yaml	new-data (OWASP#35)	Sep 4, 2021
Purge authentication data after session termination.yaml		Purge authentication data after session termination.yaml	new-data (OWASP#35)	Sep 4, 2021
RESTful.yaml		RESTful.yaml	new-data (OWASP#35)	Sep 4, 2021
Re-authentication from federation or assertion.yaml		Re-authentication from federation or assertion.yaml	new-data (OWASP#35)	Sep 4, 2021
Realistic human pase business logic flows timing.yaml		Realistic human pase business logic flows timing.yaml	new-data (OWASP#35)	Sep 4, 2021
Regular backups and test restoration.yaml		Regular backups and test restoration.yaml	new-data (OWASP#35)	Sep 4, 2021
Relevant output encoding for interpreter .yaml		Relevant output encoding for interpreter .yaml	new-data (OWASP#35)	Sep 4, 2021
Repeatable deployment procedures.yaml		Repeatable deployment procedures.yaml	new-data (OWASP#35)	Sep 4, 2021
Replacable keys.yaml		Replacable keys.yaml	new-data (OWASP#35)	Sep 4, 2021
Resistance against stolen credentials.yaml		Resistance against stolen credentials.yaml	new-data (OWASP#35)	Sep 4, 2021
Restrict excessive authentication.yaml		Restrict excessive authentication.yaml	new-data (OWASP#35)	Sep 4, 2021
Restrictive XML parsing configuration.yaml		Restrictive XML parsing configuration.yaml	new-data (OWASP#35)	Sep 4, 2021
Role based privilage assessment upon data-feature access.yaml		Role based privilage assessment upon data-feature access.yaml	new-data (OWASP#35)	Sep 4, 2021
SOAP.yaml		SOAP.yaml	new-data (OWASP#35)	Sep 4, 2021
Safe character sets for HTTP response.yaml		Safe character sets for HTTP response.yaml	new-data (OWASP#35)	Sep 4, 2021
SameSite attribute for cookie-based session tokens.yaml		SameSite attribute for cookie-based session tokens.yaml	new-data (OWASP#35)	Sep 4, 2021
Sandboxing third party libraries.yaml		Sandboxing third party libraries.yaml	new-data (OWASP#35)	Sep 4, 2021
Sanitization and sandboxing.yaml		Sanitization and sandboxing.yaml	new-data (OWASP#35)	Sep 4, 2021
Sanitize unstructured data.yaml		Sanitize unstructured data.yaml	new-data (OWASP#35)	Sep 4, 2021
Sanitize untrusted HTML input.yaml		Sanitize untrusted HTML input.yaml	new-data (OWASP#35)	Sep 4, 2021
Sanitize, disable, or sandboxe untrusted SVG scriptable contet.yaml		Sanitize, disable, or sandboxe untrusted SVG scriptable contet.yaml	new-data (OWASP#35)	Sep 4, 2021
Sanitize, disable, or sandboxe untrusted scriptable or expression template language content.yaml		Sanitize, disable, or sandboxe untrusted scriptable or expression template language content.yaml	new-data (OWASP#35)	Sep 4, 2021
Secret attribute for cookie-based session tokens.yaml		Secret attribute for cookie-based session tokens.yaml	new-data (OWASP#35)	Sep 4, 2021
Secret storage.yaml		Secret storage.yaml	new-data (OWASP#35)	Sep 4, 2021
Secrets shared with clients only for low risk.yaml		Secrets shared with clients only for low risk.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure SDLC in every step.yaml		Secure SDLC in every step.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure User Management.yaml		Secure User Management.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure and repeatable application build.yaml		Secure and repeatable application build.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure auto-update over full stack.yaml		Secure auto-update over full stack.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure backup storage.yaml		Secure backup storage.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure communication.yaml		Secure communication.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure data storage.yaml		Secure data storage.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure management policy for cryptographic keys.yaml		Secure management policy for cryptographic keys.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure name-address resolution service.yaml		Secure name-address resolution service.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure random values.yaml		Secure random values.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure storage of credentials.yaml		Secure storage of credentials.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure storage of cryptographic keys.yaml		Secure storage of cryptographic keys.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure storage of session cossies.yaml		Secure storage of session cossies.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure transfer of logs.yaml		Secure transfer of logs.yaml	new-data (OWASP#35)	Sep 4, 2021
Secure user management.yaml		Secure user management.yaml	new-data (OWASP#35)	Sep 4, 2021
Securely store regulated data.yaml		Securely store regulated data.yaml	new-data (OWASP#35)	Sep 4, 2021
Security and Privacy Engineering Principles.yaml		Security and Privacy Engineering Principles.yaml	new-data (OWASP#35)	Sep 4, 2021
Sensitive personal data is purged.yaml		Sensitive personal data is purged.yaml	new-data (OWASP#35)	Sep 4, 2021
Seperate storage of user uploaded files.yaml		Seperate storage of user uploaded files.yaml	new-data (OWASP#35)	Sep 4, 2021
Serialization of untrusted communication.yaml		Serialization of untrusted communication.yaml	new-data (OWASP#35)	Sep 4, 2021
Session logout and timeout.yaml		Session logout and timeout.yaml	new-data (OWASP#35)	Sep 4, 2021
Session management.yaml		Session management.yaml	new-data (OWASP#35)	Sep 4, 2021
Session token generation.yaml		Session token generation.yaml	new-data (OWASP#35)	Sep 4, 2021
Set path attribute in cookie-bases session tokens precise if different domains.yaml		Set path attribute in cookie-bases session tokens precise if different domains.yaml	new-data (OWASP#35)	Sep 4, 2021
Single use numbers used once.yaml		Single use numbers used once.yaml	new-data (OWASP#35)	Sep 4, 2021
Single vetted mature authentication mechanism.yaml		Single vetted mature authentication mechanism.yaml	new-data (OWASP#35)	Sep 4, 2021
Standardized reject headers for requests.yaml		Standardized reject headers for requests.yaml	new-data (OWASP#35)	Sep 4, 2021
Strong authenticators have priority and weak authenticators only for less secure access.yaml		Strong authenticators have priority and weak authenticators only for less secure access.yaml	new-data (OWASP#35)	Sep 4, 2021
Strongly typed and validated structured data.yaml		Strongly typed and validated structured data.yaml	new-data (OWASP#35)	Sep 4, 2021
Subsciber-provided authentication devices are supported.yaml		Subsciber-provided authentication devices are supported.yaml	new-data (OWASP#35)	Sep 4, 2021
Syncronized time zones for logs .yaml		Syncronized time zones for logs .yaml	new-data (OWASP#35)	Sep 4, 2021
System time synchronization.yaml		System time synchronization.yaml	new-data (OWASP#35)	Sep 4, 2021
TLS.yaml		TLS.yaml	new-data (OWASP#35)	Sep 4, 2021
Tags.yaml		Tags.yaml	new-data (OWASP#35)	Sep 4, 2021
Terminate all sessions when password is changed.yaml		Terminate all sessions when password is changed.yaml	new-data (OWASP#35)	Sep 4, 2021
Terminate session after logout.yaml		Terminate session after logout.yaml	new-data (OWASP#35)	Sep 4, 2021
Thread safty on high value logic flows.yaml		Thread safty on high value logic flows.yaml	new-data (OWASP#35)	Sep 4, 2021
Threat model every design change or sprint .yaml		Threat model every design change or sprint .yaml	new-data (OWASP#35)	Sep 4, 2021
Time-based one-time passowrd have defined lifetime.yaml		Time-based one-time passowrd have defined lifetime.yaml	new-data (OWASP#35)	Sep 4, 2021
Time-based one-time password can be used only once.yaml		Time-based one-time password can be used only once.yaml	new-data (OWASP#35)	Sep 4, 2021
Timely schema validation for JSON.yaml		Timely schema validation for JSON.yaml	new-data (OWASP#35)	Sep 4, 2021
Token-based session management.yaml		Token-based session management.yaml	new-data (OWASP#35)	Sep 4, 2021
Trusted enforcement points for access controls.yaml		Trusted enforcement points for access controls.yaml	new-data (OWASP#35)	Sep 4, 2021
Trusted origin of third party resources.yaml		Trusted origin of third party resources.yaml	new-data (OWASP#35)	Sep 4, 2021
Type validation of untrusted data.yaml		Type validation of untrusted data.yaml	new-data (OWASP#35)	Sep 4, 2021
Ubiquitous exceprion handeling.yaml		Ubiquitous exceprion handeling.yaml	new-data (OWASP#35)	Sep 4, 2021
Unified encoders and parsers throughout the application.yaml		Unified encoders and parsers throughout the application.yaml	new-data (OWASP#35)	Sep 4, 2021
Unprivilaged andvalidated untrusted files.yaml		Unprivilaged andvalidated untrusted files.yaml	new-data (OWASP#35)	Sep 4, 2021
Updated third party components.yaml		Updated third party components.yaml	new-data (OWASP#35)	Sep 4, 2021
Usage of proper source code control systems.yaml		Usage of proper source code control systems.yaml	new-data (OWASP#35)	Sep 4, 2021
Use memory safe strings.yaml		Use memory safe strings.yaml	new-data (OWASP#35)	Sep 4, 2021
Use only strong Comunication encryption protocols.yaml		Use only strong Comunication encryption protocols.yaml	new-data (OWASP#35)	Sep 4, 2021
Use parameterization to create queries.yaml		Use parameterization to create queries.yaml	new-data (OWASP#35)	Sep 4, 2021
Useage of effective SAST tools.yaml		Useage of effective SAST tools.yaml	new-data (OWASP#35)	Sep 4, 2021
User based functionality access limitations.yaml		User based functionality access limitations.yaml	new-data (OWASP#35)	Sep 4, 2021
User passwords are of sufficiently minimum length.yaml		User passwords are of sufficiently minimum length.yaml	new-data (OWASP#35)	Sep 4, 2021
User submitted filenames processed to protect local files.yaml		User submitted filenames processed to protect local files.yaml	new-data (OWASP#35)	Sep 4, 2021
User submitted filenames processed to protect remote files.yaml		User submitted filenames processed to protect remote files.yaml	new-data (OWASP#35)	Sep 4, 2021
Validate HTTP reqeuest headers.yaml		Validate HTTP reqeuest headers.yaml	new-data (OWASP#35)	Sep 4, 2021
Validate befire sensitive transactions.yaml		Validate befire sensitive transactions.yaml	new-data (OWASP#35)	Sep 4, 2021
Validate untrusted filenames.yaml		Validate untrusted filenames.yaml	new-data (OWASP#35)	Sep 4, 2021
Verifiable security relevant configuration.yaml		Verifiable security relevant configuration.yaml	new-data (OWASP#35)	Sep 4, 2021
Verify TLS authenticity.yaml		Verify TLS authenticity.yaml	new-data (OWASP#35)	Sep 4, 2021
Weak (clar text) authenticators not offered by default.yaml		Weak (clar text) authenticators not offered by default.yaml	new-data (OWASP#35)	Sep 4, 2021
Weak crypto not preferred.yaml		Weak crypto not preferred.yaml	new-data (OWASP#35)	Sep 4, 2021
White-list CORS header .yaml		White-list CORS header .yaml	new-data (OWASP#35)	Sep 4, 2021
Whitelist redirected URLs.yaml		Whitelist redirected URLs.yaml	new-data (OWASP#35)	Sep 4, 2021
Whitelisting data sources and sinks.yaml		Whitelisting data sources and sinks.yaml	new-data (OWASP#35)	Sep 4, 2021
Whitelisting file extentions.yaml		Whitelisting file extentions.yaml	new-data (OWASP#35)	Sep 4, 2021
Whitelisting verification of all input.yaml		Whitelisting verification of all input.yaml	new-data (OWASP#35)	Sep 4, 2021
Wireless link protection.yaml		Wireless link protection.yaml	new-data (OWASP#35)	Sep 4, 2021
XSD schema validation.yaml		XSD schema validation.yaml	new-data (OWASP#35)	Sep 4, 2021
XSS.yaml		XSS.yaml	new-data (OWASP#35)	Sep 4, 2021
db.sqlite		db.sqlite	Fix hierarchy jumps (OWASP#74)	Sep 16, 2021
limit size and number of uploaded files.yaml		limit size and number of uploaded files.yaml	new-data (OWASP#35)	Sep 4, 2021
log access to sensitive data.yaml		log access to sensitive data.yaml	new-data (OWASP#35)	Sep 4, 2021
log times of the events.yaml		log times of the events.yaml	new-data (OWASP#35)	Sep 4, 2021
no caching of sensitive data in browser.yaml		no caching of sensitive data in browser.yaml	new-data (OWASP#35)	Sep 4, 2021
no data exposure through API URL.yaml		no data exposure through API URL.yaml	new-data (OWASP#35)	Sep 4, 2021
no data exposure through HTTP verb.yaml		no data exposure through HTTP verb.yaml	new-data (OWASP#35)	Sep 4, 2021
proper generation of GUIDs.yaml		proper generation of GUIDs.yaml	new-data (OWASP#35)	Sep 4, 2021
properly enable certification revocation.yaml		properly enable certification revocation.yaml	new-data (OWASP#35)	Sep 4, 2021
protection against OS command injection attack.yaml		protection against OS command injection attack.yaml	new-data (OWASP#35)	Sep 4, 2021
secure communication.yaml		secure communication.yaml	new-data (OWASP#35)	Sep 4, 2021
sufficient time for renewal of bound authenticators..yaml		sufficient time for renewal of bound authenticators..yaml	new-data (OWASP#35)	Sep 4, 2021
usage of side channel attack resistant cryptography.yaml		usage of side channel attack resistant cryptography.yaml	new-data (OWASP#35)	Sep 4, 2021
virus scanning of untrusted files.yaml		virus scanning of untrusted files.yaml	new-data (OWASP#35)	Sep 4, 2021
white-list valid HTTP methods.yaml		white-list valid HTTP methods.yaml	new-data (OWASP#35)	Sep 4, 2021
View all files