OWASP

OWASP Foundation Unveils Its Strategic Plan for a World Without Insecure Software

Andrew van der Stock — 2026-05-05T07:00:00+00:00

The OWASP Foundation is entering a defining moment.

This strategic plan outlines how OWASP will move from being a recognized voice in security to a truly transformative force in the industry.

Inside this document, you’ll find a clear roadmap for tackling one of the most urgent challenges of our time: eliminating insecure software at scale.

What You’ll Learn:

This strategic plan provides a comprehensive look at how OWASP will drive meaningful, lasting impact through these five strategic areas:

Why This Matters:

Software insecurity isn’t just a technical issue; it’s a global risk.

It affects businesses, governments, and individuals alike, costing billions, eroding trust, and exposing critical systems to failure. OWASP’s strategy addresses these challenges head-on by combining community, education, and open innovation into a unified approach.

This isn’t just a plan, it’s our call to action for anyone invested in the future of secure software.

Download the Strategic Plan

Get the full document to explore OWASP’s vision, mission, and five strategic priorities in detail.

OWASP Foundation Strategic Plan

Be Part of the Mission

OWASP is powered by a global community. Whether you contribute to our Projects and Chapter, share knowledge, or support initiatives, your involvement helps move the world closer to secure software for all.

About the OWASP Foundation

Our vision - “No more insecure software.”

The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation that works to improve software security. Our programming includes:

Community-led open-source projects, including code, documentation, and standards
Over 250+ local chapters worldwide
Tens of thousands of members and participants
Industry-leading educational and training conferences

We are an open community dedicated to enabling organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. Our projects, tools, documents, forums, and chapters are free and open to anyone interested in improving application security. The OWASP Foundation launched on December 1st, 2001, becoming incorporated as a United States non-profit charity on April 21, 2004.

Corporations, foundations, developers, and volunteers have supported the OWASP Foundation and its work for two decades. Donate, become a Member, or a Corporate Supporter today.

Media Contact

For further inquiries, please contact:

Andrew van der Stock

Executive Director, andrew.vanderstock@owasp.com

Stay tuned for more exciting updates. Follow OWASP on LinkedIn, Mastodon, and X

The OWASP Foundation appoints Missie Lindsey as Director of Corporate Relations

Andrew van der Stock — 2026-04-27T07:00:00+00:00

New Orleans, LA — The OWASP Foundation is pleased to announce the appointment of Missie Lindsey as Director of Corporate Relations. Missie brings more than 18 years of experience in B2B marketing, corporate partnerships, and account-based engagement across technology, trade, and mission driven organizations.

Missie comes to OWASP with a strong background in corporate account management, having built and managed robust portfolios of high value, strategic partners and curated VIP engagement experiences that deepen long term relationships. She has previously been responsible for identifying, securing, and maintaining corporate partnerships at a leading SaaS technology company, converting new business opportunities into lasting alliances while ensuring existing partners remained engaged and well-supported.

Her career also spans a decade in international trade, where she engaged directly with C-suite executives and business owners, not only as a featured speaker at more than 40 industry events annually, but as a strategic relationship builder focused on recruiting top level decision makers into export programs that expanded their business presence across Asia, Canada, Europe, and the Middle East. Missie’s proven ability to open doors at the executive level, forge new corporate alliances, and grow partner networks across diverse industries makes her exceptionally well positioned to drive OWASP’s corporate partner community forward.

“I’m thrilled to welcome Missie Lindsey to the OWASP Foundation as our Director of Corporate Relations. Missie brings a rare combination of B2B partnership expertise, strategic account management, and a genuine talent for building relationships that create long term value. She will be instrumental in expanding and deepening our corporate sponsor relationships, developing new partnership tiers, fundraising, revamping our donations platform, and driving the revenue pipeline that enables OWASP to continue delivering world class open-source security resources to the global community. Please join me in welcoming Missie to the team,” Andrew van der Stock, Executive Director of the OWASP Foundation.

Missie will focus her initial efforts on connecting with OWASP’s existing corporate supporters and partners, identifying new strategic alliance opportunities, and building out the infrastructure to support a growing portfolio of corporate relationships aligned with OWASP’s mission to improve software security worldwide.

About the OWASP Foundation

Our vision - “No more insecure software.”

The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation that works to improve software security. Our programming includes:

Community-led open-source projects, including code, documentation, and standards
Over 250+ local chapters worldwide
Tens of thousands of members and participants
Industry-leading educational and training conferences

Corporations, foundations, developers, and volunteers have supported the OWASP Foundation and its work for two decades. Donate, become a Member, or a Corporate Supporter today.

Media Contact

For further inquiries, please contact:

Andrew van der Stock

Executive Director, andrew.vanderstock@owasp.com

Stay tuned for more exciting updates. Follow OWASP on LinkedIn, Mastodon, and X

Bridging the Gap in Product Lifecycle Management: How OpenEoX and CLE Work Together

Jordan Harband and Przemyslaw (Rogue) Roguski — 2026-04-15T07:00:00+00:00

OpenEoX and CLE are two emerging standards that work together to solve a critical gap in how organizations track whether the software and hardware they depend on is still supported, and their collaboration could reshape how the entire industry manages product lifecycle risk.

In the rapidly evolving landscape of software and hardware supply chains, tracking products’ longevity is a notable challenge, especially it is a critical challenge for organizations managing complex technology portfolios. As highlighted in the OpenEoX Standardization Framework Technical Report, industry is facing significant security and operational risks due to inconsistent, unreliable, and often missing End-of-Life (EoL) and End-of-Security-Support (EoSSec) or End-of-Sales (EoS) information. Emerging regulations like EU Cyber Resilience Act (CRA) elevate lifecycle transparency from a risk management concern to a mandatory compliance requirement with potential legal and financial consequences for non-compliance.

Without a standardized machine readable language for lifecycle information exchange, organizations struggle to identify unsupported products, leading to security blind spots where unpatched vulnerabilities can persist indefinitely and present risk. Product users might not even be aware that the specific product is no longer supported or close to the EoL, and quick remediation steps are required. The lack of a unified framework to exchange this information often leaves consumers guessing about the support status of the technologies they rely on, increasing the likelihood of cyberattacks and operational disruptions.

To solve these systemic issues, two major initiatives have emerged: the OpenEoX framework and the Common Lifecycle Enumeration (CLE) standard.

Understanding OpenEoX and CLE

While both initiatives aim to bring clarity to product lifecycles, they approach the problem from different, yet complementary, angles.

OpenEoX (managed by the OASIS OpenEoX Technical Committee) is a comprehensive framework designed and still developed to standardize the exchange of life cycle information. It focuses on the broader “policy” aspect of lifecycle management, defining a common taxonomy for critical milestones such as:

General Availability (GA): Initial product release date
End-of-Sales (EoS): Last date for product purchase from vendor channels
End-of-Security-Support (EoSSec): Termination of security patch availability
End-of-Life (EoL): Cessation of all vendor support and maintenance

The OpenEoX schema is structured to communicate a product’s entire support policy and timeline, making it ideal for describing complex support scenarios often found in commercial software and hardware.

Common Lifecycle Enumeration (CLE) (standardized as ECMA-428 and managed by Ecma TC54-TG3) is an open standard focused on enumerating specific lifecycle events and handling component aliasing. The CLE schema excels at providing a structured, machine-readable format for discrete events (like a specific version going EoL) and tracking identity changes (aliasing) as a component evolves or changes ownership. It is designed to be a lightweight, precise method for linking a specific component artifact to a lifecycle status.

Distinct Use Cases: Vendors vs. Maintainers

The fundamental distinction between OpenEoX and CLE lies in their architectural complexity and target adoption contexts, reflecting different organizational needs and operational constraints:

OpenEoX is tailored for complex use cases, particularly those involving larger software and hardware vendors. Its schema allows for the definition of detailed support policies that may include multiple tiers of support (e.g., standard vs. extended support), regional variations, and dependency relationships. It provides a “big picture” view of a product’s lifecycle strategy, which is essential for enterprise vendors managing extensive portfolios. It can cover complex software and hardware products, which rely on many artifacts and dependencies (downstream and upstream).

CLE, in contrast, is designed to be easily adopted by single open-source content maintainers. Its lightweight nature means a maintainer can quickly publish a CLE record to signal a specific event, such as “Version 1.2.3 is now End-of-Life” or “Project X has been renamed to Project Y”, without needing to construct a complex policy document. This makes CLE highly effective for the decentralized nature of the open-source ecosystem, where speed and simplicity are paramount.

Collaboration: A Unified Future

Recognizing the complementary strengths of both frameworks, stakeholders from the OASIS OpenEoX Technical Committee and Ecma TC54-TG3 (CLE working group) have formally established a collaborative partnership, explicitly affirming that OpenEoX and CLE address distinct yet interconnected aspects of lifecycle management rather than competing alternatives. In short, these standards do not compete with each other. Instead, both working groups are committed to a collaborative model where each standard supplements the other to cover the full spectrum of lifecycle management.

In a unified ecosystem, OpenEoX can be used to transport high-level policy data and extensive vendor timelines, while CLE can serve as the granular identifier mechanism that links those policies to specific software artifacts and tracks their evolution over time. For example, an OpenEoX document might reference CLE identifiers to precisely pinpoint the components affected by a policy change, or a CLE event might point to an OpenEoX document for further context on a migration path.

Summary

The OpenEoX and CLE standardization initiatives are actively engaged in collaborative development to ensure interoperability and prevent specification conflicts that could fragment the lifecycle management ecosystem. By aligning their efforts, they aim to address all types of product lifecycle problems, from the complex, policy-driven requirements of major vendors to the agile, event-driven needs of open-source maintainers. Together, OpenEoX and CLE establish a robust, interoperable foundation for systematic lifecycle management, enabling organizations to proactively identify unsupported dependencies, satisfy emerging regulatory compliance requirements and mitigate supply chain security risks through transparent, machine-readable lifecycle information exchange.

OpenEoX and CLE communities

References

OASIS OpenEoX Technical Committee. (2025). OpenEoX Standardization Framework Technical Report. OASIS Open.
Ecma International. (2024). ECMA-428: Common Lifecycle Enumeration (CLE) Standard. Ecma TC54-TG3.
European Parliament and Council. (2024). Regulation (EU) 2024/2847 on Cybersecurity Requirements for Products with Digital Elements (Cyber Resilience Act).

Jordan Harband
Ecma Technical Committee 54, TG3 Convenor

Przemyslaw (Rogue) Roguski
OASIS OpenEoX Technical Committee member

Announcing the Retirement of OWASP Meetup Platform

Andrew van der Stock — 2026-01-13T07:00:00+00:00

There is no easy way to say this, so here goes. OWASP will be retiring Meetup, effective January 31, 2026. This impacts attendees and chapter leaders. Retiring Meetup in such a short time is not how any of us would have planned to do it, but we must make the best of a tough situation. OWASP’s new website will shortly go live and take over the hosting of all chapter meetings, improving the usability for attendees and chapter leaders, and reducing the complexity of managing chapters to a single platform. Initially, not all necessary functionality that is currently available to organizers will be present, but it will get there in the end.

Calls to Action:

Attendees. If you want to attend a chapter meeting, you will be able to search for your chapter and find the next meetings through a meeting calendar. We will have further improvements as time goes on, such as finding your nearest chapter, but for now, discovery of new chapter meetings will be straightforward if you know the name of your chapter.
Chapter Leaders. If you are due to host a meeting in early February, please update your chapter home page on GitHub to include the meeting, as any delays in the new website going live will mean your chapter event may not get noticed. Please notify us in #leaders on Slack so we can prioritize your onboarding so you can publish your meetings on the new website as soon as it goes live. For all other Chapter leaders, please stay tuned in #leaders for more communications and training to help you migrate to our new website. If you need to have RSVPs for your meetings (such as site security needing a visitor list), please use a Google Form for this until we have the functionality built into the website. Only store Google Forms in your OWASP account to ensure that we meet our obligations under the GDPR. Please delete the form and its data once the meeting has passed.

Why must we make this change?

In the last few working days of 2025, we learned that our annual Meetup renewal pricing was due to dramatically increase, tripling our costs by 2027 if we maintained our current group numbers. Our Meetup Pro subscription is already OWASP’s largest single software cost. We are a non-profit organization with limited financial resources, and if we renewed, it would mean cutting other programs sharply, such as projects and outreach, and reducing the number of chapters that have a Meetup group, something that goes against our mission. Renewing would hamper chapter growth, and create two tiers of chapters, create an operational nightmare, and we would still need to come up with something for chapters without Meetup, and then try to work out how to fix the user experience of attending chapter meetings. No matter what, we were going to have to create additional functionality in our website for some of our chapters and then figure out which programs to cut. Renewing creates more work, not less. Not renewing, although painful, we invest once in improving the website to cover all chapters and attendees over time.

As stated above, not all Meetup functionality will be present on launch day, but we will get there with Chapter Leaders’ help by prioritizing the creation of missing functionality. For example, current Meetup functionality, such as attendees joining a chapter, mail outs to past attendees, RSVPs, hidden Zoom links, meeting metrics, and searching for inactive chapters will not be available. We need time to develop and mature the functionality to ensure data security and privacy of attendees is in place and is in line with our obligations under the GDPR and other privacy laws and regulations. In an ideal world, we would have more time to make the change, but OWASP must move off Meetup by the end of January.

Sadly, this is the end of the road for OWASP and Meetup. This decision was mine to make and I did not make it lightly. It will be painful to many. Meetup served our community well for nearly two decades, helping local chapters grow and connect with security practitioners, executives and leadership, and developers worldwide. This parting reminds me of one of my favorite books, from the Hitch Hiker’s Guide to the Galaxy: “So long, and thanks for all the fish.” This is the farewell message the dolphins gave humans just before they evacuated Earth, just before the Earth was destroyed by the Vogons. I am not suggesting that Meetup will be destroyed; all similes break down if you push them hard. Our farewell is meant with good humor, warmth, and gratitude. We will miss Meetup. I wish Meetup well and hope their new pricing model works for them, even if I have doubts.

If you are an attendee, please continue to use #owasp-community on Slack. If you are a Leader, and have questions or need assistance during the transition, please reach out to #leaders on Slack or the Leaders mailing list.

thanks,

Andrew van der Stock Distinguished Lifetime Member Executive Director, OWASP

The OWASP Foundation appoints Stacey Ebbs as Communications & Marketing Manager

Andrew van der Stock — 2025-11-19T07:00:00+00:00

The OWASP Foundation is pleased to announce the appointment of Stacey Ebbs as Communications and Marketing Manager. Stacey brings more than a decade of experience in marketing, events, and community engagement within the cybersecurity and technology sectors.

Stacey joins OWASP from IriusRisk, where she served as Field & Partner Marketing Manager for EMEA, leading regional campaigns, managing partner and social strategy, and driving global community engagement through initiatives like the Threat Modeling Connect community. She has been a key organizer for conferences and events worldwide and currently serves as one of the London Chapter Leaders for Threat Modeling Connect.

Her career also includes event and marketing leadership roles at F-Secure Consulting and Apple Retail UK, where she honed her expertise in communications strategy, partner relations, and brand development. Stacey’s extensive experience in coordinating global events, producing compelling marketing content, and fostering community collaboration aligns perfectly with OWASP’s mission to improve application security worldwide.

A long-time advocate of OWASP’s values, Stacey brings both professional experience and personal passion to her new role. Her work at the intersection of marketing, community building, and cybersecurity will help OWASP strengthen member engagement, amplify global initiatives, and tell the story of OWASP’s impact as it approaches its 25th Anniversary.

“I’m thrilled to welcome Stacey Ebbs as the OWASP Foundation’s first-ever Communications and Marketing Manager. With deep experience engaging developers, AppSec professionals, and industry leaders, Stacey will lead a strategic refresh of how OWASP tells its story through compelling social media, case studies, annual reports, and community-driven content. As she refines our marketing approach with a focus on our core values of openness, transparency, integrity, and vendor neutrality, Stacey will collaborate closely with our community, leaders, and staff to spotlight the incredible work behind our projects, chapters, events, donors, sponsors, and supporters. Stacey arrives just in time for OWASP’s 25th Anniversary! Please welcome Stacey to our team - I’m sure you’ll be hearing from her soon.”, says Andrew van der Stock, Executive Director of the OWASP Foundation.

Stacey will begin her role by collaborating with OWASP’s leadership and community teams to refine global communications, enhance outreach to chapters and members, and lead initiatives around OWASP’s milestone anniversary celebrations.

About the OWASP Foundation

Our vision - “No more insecure software.”

The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation that works to improve software security. Our programming includes:

Community-led open-source projects, including code, documentation, and standards
Over 250+ local chapters worldwide
Tens of thousands of members and participants
Industry-leading educational and training conferences

Corporations, foundations, developers, and volunteers have supported the OWASP Foundation and its work for two decades. Donate, become a Member, or a Corporate Supporter today.

Media Contact

For further inquiries, please contact:

Andrew van der Stock

Executive Director, andrew.vanderstock@owasp.com

Stay tuned for more exciting updates. Follow OWASP on LinkedIn, Mastodon, and X

OWASP Certified Secure Software Developer

Shruti Kulkarni — 2025-10-03T07:00:00+00:00

To develop applications we need code. To write code we need developers. And to develop secure applications, developers need to write code that does not result in or have vulnerabilities.

OWASP is about application security - be it web application, mobile application, applications developed with low-code-no-code, infrastructure-as-code, etc.

OWASP is currently working on a new initiative to create a certification program for developers. It is named OWASP Certified Secure-Software Developer - OCSD.

This certification is aimed to help developers to showcase their skills in writing secure code.

The certification program is an answer to the questions a hiring manager may have, when interviewing a developer. It is also for the developers who want to showcase their skills in developing secure code.

Remember:

Writing secure code != testing the security of code with tools
If developers do not put security in the code, no one else will

The questions we may want to ask are:

If I am hiring an application developer, what are the security related skills I would look for?
If I were an application developer what security skills would I like to be validated for?

This certification program seeks to provide answers to these questions.

Stay tuned for more updates in this space.

GSoC 2025 Recap

Fabio Cerullo & Starr Brown — 2025-10-01T07:00:00+00:00

OWASP at Google Summer of Code 2025

Celebrating real impact, strong mentorship, and a growing community

The Google Summer of Code (GSoC) 2025 program has wrapped, and OWASP’s participation once again delivered meaningful improvements across the open-source security ecosystem. This year, 15 contributors worked across multiple OWASP projects, supported by 26 mentors. Of the 15 projects evaluated, 10 reached successful completion, three are still working on the final deliveries with extended deadlines, and two unfortunately not making the finish line.

Beyond code merged and features shipped, GSoC 2025 strengthened the pipeline of new contributors, future maintainers, and next-year mentors. Here’s a closer look at what we achieved together.

Program Snapshot

Contributors: 15
Mentors: 26 across the OWASP community
Project outcomes: 10 completed; 3 in progress, 2 not completed
Focus: Enhancing established tools, modernizing codebases, and exploring new AppSec directions

Project Highlights

OWASP Nest: API & Schema Development

Migrated the API toward Django Ninja, optimizing REST endpoints and paving the way for clearer schemas, better performance, and more maintainable service boundaries.

PyGoat v3: Architecture & Learning Experience Redefined

A major upgrade to OWASP PyGoat, the educational vulnerable app, focusing on modular architecture, clearer lab flows, and better secure-coding learning outcomes.

Nettacker: Recon Scan Improvements & Task Handling

Enhanced OWASP Nettacker with better reconnaissance scanning features and optimized task handling to reduce noise, improve reliability, and streamline operator feedback loops.

OWTF: MiTM Proxy Modernization

Modernized the Man-in-the-Middle proxy inside OWASP OWTF to improve stability and compatibility with evolving browser/proxy ecosystems.

OWASP OpenCRE: Gap Analysis Performance Optimization

Optimized gap analysis with improved Neo4j performance, AI-driven mappings between CREs and controls, and enhanced visualizations. Frontend upgrades for greater usability, responsiveness, and clarity.

OWASP BLT

Several impactful projects were developed to enhance open-source security, education, and contributor engagement:

Sahil Dhillon built an AI-powered GitHub assistant that helps maintainers review code, detect security vulnerabilities, and prioritize tasks using LLMs and rule-based scanning—all integrated into a GitHub bot and task management dashboard.
Krrish Sehgal extended OWASP BLT with a blockchain-backed, AI-scored gamification system to incentivize contributions like bug triaging and fixes.
Lucky Negi developed browser-based, interactive security labs for hands-on vulnerability triage and secure coding practice through gamified exercises.
Rinkita Dhana redesigned the OWASP BLT organization dashboard with real-time analytics, advanced filtering, and role-based collaboration tools to streamline team workflows and vulnerability management.

Together, these projects significantly advanced the usability, security, and educational value of the OWASP BLT ecosystem.

What Made These Projects Succeed

1. Focused Scoping & Iteration

Successful projects started with achievable milestones, then iterated toward stretch goals. Weekly demos, small PRs, and fast feedback helped contributors maintain momentum.

2. Communication Cadence

Mentors and contributors kept a regular rhythm: weekly 1:1s, short written updates, and community calls, so risks surfaced early and success was visible to the wider community.

3. Visibility & Recognition

Lightning talks, end-of-program showcases, and social posts gave contributors credit and confidence, while helping other projects discover reusable ideas.

4. Progressive Responsibility

As contributors matured, they took on triage, code reviews, or small leadership tasks.

Mentor & Org Admin Practices That Worked (and We’ll Repeat)

Set expectations early. Share onboarding docs, a “first-10-days” checklist, and communication norms before coding starts.
Require “commit early, commit often.” Small pull requests are easier to review and teach maintainers’ expectations quickly.
Pair mentorship. At least two mentors per project mitigates availability risks and reduces burnout.
Assess with real tasks. Simple environment-bring-up and “good first issue” tasks during selection predict success better than proposals alone.
Document a clear escalation path. If communication stalls, contributors know exactly how and when to reach Org Admins.

Making the Most of Community Bonding

The Community Bonding period is where retention begins. This year we emphasized:

Welcome fast. Mentors greeted accepted contributors within 24 hours, then invited them to weekly community calls.
Context first. We explained why a project matters, where it’s used, and how it helps the broader AppSec community.
Lightweight structure. A shared roster (handles, proposals, repos, blog links), a weekly meeting schedule, and a short public update cadence.
Clear expectations. “Communicate early, communicate often”, and yes, check your email for program notices and logistics.

Get Involved

Contribute: Pick an OWASP project that aligns with your skills or interests and say hello in the project’s channels.
Mentor: If you’re a maintainer or experienced contributor, consider mentoring next year.
Propose Ideas: Help shape our next GSoC by proposing scoped, contributor-friendly project ideas with clear milestones.
Contributor Fair: Join the Contributor Fair at OWASP Global AppSec US 2025 in Washington, DC this November. Details are available here.

If you’re interested in contributing or mentoring in GSoC 2026, keep an eye on OWASP community channels for timelines, idea lists, and onboarding sessions. Let’s build on the momentum of 2025 together!

Thank You

Heartfelt thanks to our contributors & mentors and the wider OWASP community. Whether you shipped a feature, reviewed code, wrote docs, or helped someone get unblock—you moved AppSec forward.

Fabio Cerullo and Starr Brown
OWASP Org Admins

Published: October 2025 ```

OWASP Top 10 Community Survey

Starr Brown — 2025-09-26T07:00:00+00:00

Help Shape the Future of Web Application Security: OWASP Top 10 - 2025 Community Survey Now Open!

The digital threat landscape is constantly evolving and so are the ways we defend against it. At the heart of that defense is the OWASP Top 10, a globally recognized standard for web application security. It’s more than just a list; it’s a reflection of what the security community sees, experiences, and prioritizes in real-time.

And now, as we look ahead to OWASP Top 10 - 2025, we’re calling on the global AppSec and development community to lend their voices, expertise, and perspectives to this critical update.

Why Your Voice Matters

The OWASP Top 10 isn’t decided behind closed doors-it’s a collaborative effort driven by real-world data and informed by practitioners on the front lines. Your feedback ensures this list remains not only technically accurate, but also relevant, inclusive, and actionable for organizations and teams of all sizes and structures.

Whether you’re a seasoned security leader, a developer who’s learned through hard-won experience, or someone just getting started in the field - you have something valuable to contribute.

What We’re Asking

We’re gathering input through a brief, focused survey designed to capture what you’re seeing today and where you think the future of web security is headed. From emerging threats to shifting priorities, this is your opportunity to help guide what will become a foundational resource for developers, educators, auditors, and companies around the world.

The deadline to submit feedback is October 3, 2025. Take the survey now: https://forms.gle/jL3r5Xgg1Hj2bv2B9

Let’s Build This Together

Security is a shared responsibility. So is progress. The OWASP community has always been grounded in openness, transparency, and collective wisdom and this next iteration of the Top 10 is no different.

Make your voice heard. Share the link. Encourage your peers and teams to participate. The more perspectives we gather, the stronger and more representative the final OWASP Top 10 - 2025 will be.

Let’s move the industry forward, together.

OWASP Elections 2025 - Become a member today!

Andrew van der Stock — 2025-09-03T00:00:00+00:00

OWASP’s direction comes from members of our community like you voting for the Global Board of Directors. Your vote is your voice, and it matters! The only way to get a ballot is to be a member on September 30, 2025. Please join or renew your membership today!

We have a large field of candidates running for the Board of Directors, and we need to make sure the community’s voice heard loud and clear by having as many OWASP members participate as possible. OWASP financial membership not only gives you a vote but also strengthens our community. Don’t miss your chance to make a difference!

Join before the price rise!

Membership starts from $20 USD for regional or student memberships, and $50 USD for one year memberships. Two year ($35/$95) and Lifetime Memberships ($200/$500) are the best value. Lifetime Membership will be going up to $750 USD soon, so now has never been a better time to become a Lifetime member!

Global AppSec Discounts

If you want to obtain a ticket to Global AppSec DC with a one year membership, this is even better value! Not only do you immediately get $100 off the admission price, you will also be an OWASP Member who is eligible to vote if you register before September 30, 2025. Scroll down to “General Conference Admission + 1 Year OWASP Membership”, select the number of attendees, and register for the event.

Creating memberships via the event registration process is a partially manual process, so please give us a few days to process your membership application after you purchase your Global AppSec DC ticket. All Global AppSec DC tickets with memberships received before September 30, 2025 will be eligible for a ballot at the forthcoming election.

Other Great OWASP Membership Perks

Membership helps sustain our mission by funding our projects, chapters, events, and the running of the Foundation itself. Some of the OWASP Membership perks include:

Ongoing support of our mission
Discounted conference and training fees
Vote in OWASP elections
Complimentary owasp.org email address
Priority access to grants, awards, and scholarships
Priority access to discounts and offers for training
Access to partner events on a discounted basis
Access to the OWASP learning platform, including OWASP projects and commercial offerings from our sponsors and partners
Access to Membership benefits offered by our partners
Early access to Global AppSec videos
And many others

Other ways to support OWASP

OWASP Membership is just one of the ways you can support OWASP’s mission.

Donations - recurring or one time - help us immeasurably. Donate Here!
Bulk Memberships. If you are an employer wishing to provide memberships to your team, please contact us.
Organizations can become a Corporate Supporter, with a wide range of benefits depending on the level chosen. Join Here!

Joining OWASP as a new member

Joining could not be simpler! Just click here to get started, select the membership type that you want, and proceed to the payment.

Obtaining your OWASP Gmail account is easy! Once your membership is confirmed, you will receive instructions on how to set up your OWASP Gmail account.

Please note: Complimentary Membership is only open to OWASP Leaders, and is a non-voting membership type. Force Majeure Complimentary Membership is a voting type of membership, but due to high levels of fraud in the past, is only available to renewing members who can provide photo identification of proof of residence at the time of renewing. In both cases, evidence of eligibility is required.

Renewing your membership

If your membership expired before November 12, 2024, just join again here. If it says that you have a membership already, please either sign in if you know your password, or use the Forgot password function, then apply for a new membership. If your membership expired after November 12, 2024, you should have an email with renewal instructions. Please follow those instructions and renew your membership.

Members who have not renewed for over 12 months are at risk of losing their Gmail and GDrive contents. Renew today to continue to have access to your Gmail and GDrive.

Difficulties joining or renewing?

If you have issues with renewing your membership, please log a ticket with our helpdesk.

Thank you for your support, and we look forward to seeing you at a future OWASP event soon!

Help Support Sherif Mansour by donating blood today!

Sherif Mansour — 2025-08-20T07:00:00+00:00

OWASP’s 2021 Board of Directors Chairman, Sherif Mansour, was recently diagnosed with acute myeloid leukemia. To help him, and everyone affected by blood cancers, the OWASP Foundation is organizing a blood donation drive. Please show your support by donating blood today!

“When I was diagnosed with acute myeloid leukemia, I didn’t know what to expect. The doctors introduced me to others on the same journey, and I have never seen such strength, generosity, and kindness in my life. No one wants to be part of this “club,” but everyone in it welcomes you with a spirit of humanity, encouragement, and compassion that humbles you. My family, my friends, and my community stood by me in ways I’ll never forget. I’m grateful to share that I am now in remission, though I still have ways to go — and I face each step with hope because of the support around me.

“One thing all of us talk about is blood donations. Leukemia treatment wipes out your immune system, leaving you dependent on transfusions of blood and platelets to survive. There is no synthetic substitute — we all live and heal because strangers give. Every donation can save up to three lives. I’ve asked my friends to donate, and many did. The OWASP Foundation have even organized a blood drive, which we hope will reach even more people. I want to encourage everyone — in InfoSec, in the professional community, and beyond — to donate blood. You’ll never know when you or someone you love will need it, but every time you do, you embody the kindness and resilience of the human spirit, and you’re part of the quiet, beautiful truth that we are here for each other.” says Sherif.

We at OWASP wish Sherif all the best, as although he is in remission, he still faces regular tests and blood transfusions. The best way for our community to support him is by donating blood. Please make a time to go donate blood today!

🌍 Global Resources:

World Health Organization – World Blood Donor Day Resources
IFRC – Find a Red Cross/Red Crescent
🇺🇸 USA – American Red Cross - AABB Blood Bank Locator
🇬🇧 UK – NHS Blood Donation
🇨🇦 Canada – Canadian Blood Services
🇦🇺 Australia – Australian Red Cross Lifeblood
🇮🇳 India – National Blood Transfusion Council - Indian Red Cross Society
🇪🇺 EU-wide – European Blood Alliance

cdxgen and CycloneDX .NET Join GitHub Secure Open Source Fund

Prabhu S. and Michael Tsfoni — 2025-08-11T07:00:00+00:00

cdxgen and CycloneDX .NET participated in the GitHub Secure Open Source Fund

Strengthening supply-chain security from the inside out.

In the domain of supply-chain security, two distinct aspects exist: security within the supply chain and the security of the supply chain itself. The CycloneDX specification, an OWASP flagship project, is supported by a community that maintains an extensive ecosystem of open-source specifications, libraries, and tools, focusing primarily on enhancing security and transparency within the supply chain. Nevertheless, there remains a critical need to strengthen the broader security of the overall supply chain by providing open-source projects and maintainers with substantial funding, essential tools, relevant knowledge, and ongoing support.

Introducing the GitHub Secure Open Source Fund (SOSF), purposefully designed to secure fast-growing dependencies critical to large projects and ecosystems. The CycloneDX community maintains many open-source tools that implement and support the specification, and we are pleased to announce that two key projects, cdxgen and CycloneDX .NET, have been selected as proud recipients and participants of GitHub’s SOSF.

Inspired by GitHub’s AI accelerator program, SOSF provides structured training and dedicated hands-on support from experts at Microsoft, GitHub, and external consultants. With substantial personal and infrastructure sponsorships, the program enables project teams to strategically plan their long-term roadmaps.

CycloneDX .NET

As the SBOM generator for .NET and .NET Framework projects, it enables developers to integrate SBOM creation directly into CI/CD pipelines.

Through the GitHub Secure Open Source Fund, we established key security processes and prepared the groundwork for long-term improvements:

Drafted an Incident Response Plan to formalize response procedures
Strengthened CI/CD pipeline security practices
Enhanced approaches for application security and sensitive data handling in SBOM generation
Initiated a threat model to guide ongoing risk analysis

The program provided structured expertise and strategic direction, positioning the project to better integrate SBOM generation into the .NET build process. Our next steps focus on implementing the threat model, expanding dependency transparency, and improving SBOM data quality.

cdxgen

As a rapidly growing project with increasing adoption, it has been an honor for cdxgen to participate in GitHub’s SOSF program. Throughout the four-week duration, our team fully utilized the resources, models, and collective knowledge provided by the cohort to comprehensively review our project’s security and infrastructure.

In collaboration with a dedicated GitHub security success buddy, we identified five significant vulnerabilities within cdxgen. With the release of versions 11.4.x and 11.5.x, we not only addressed these vulnerabilities but also mitigated entire categories of weaknesses through the implementation of comprehensive allow-listing for external commands and remote hosts. This enhanced seat-belt approach to security further establishes cdxgen as the preferred tool for generating Bill of Materials (BOM) documents at scale, suitable for both trusted and untrusted projects and container images.

Maintaining cdxgen’s infrastructure is both complex and resource-intensive, with availability in over 110 executable formats and container images. It ranks as one of the top consumers of computing and storage resources within the CycloneDX community and OWASP. Thanks to significant infrastructure sponsorship from Microsoft, we aim to resolve our computing resource bottlenecks by deploying a hybrid infrastructure that includes the Azure cloud stack, self-hosted compute resources, and GitHub Actions.

Combined with existing funding from the EU, NLNet, and private organizations, cdxgen remains sustainably positioned with a clear, long-term roadmap. As an OWASP project committed to inclusivity and diversity, we actively encourage contributors from all backgrounds and skill levels to join our efforts. Additionally, our team enthusiastically supports and practices AI-driven coding methodologies (Vibe coding).

Open source thrives when security is a shared responsibility. With the support of the GitHub Secure Open Source Fund, both CycloneDX .NET and cdxgen are poised to continue strengthening supply-chain security — and setting new standards for transparency and trust.

InfoSecMap x OWASP Collaboration

Starr Brown — 2025-06-28T07:00:00+00:00

OWASP Partners with InfoSecMap to Strengthen Global InfoSec Collaboration

We’re stronger together.

In a move that highlights the power of open collaboration, OWASP is proud to announce a new partnership with InfoSecMap — a community-focused project dedicated to making InfoSec events and resources more accessible, global, and inclusive.

At its core, OWASP is a community-driven force building free, open resources for anyone who cares about building safer software. InfoSecMap, meanwhile, has been quietly but impactfully connecting the dots across the global security ecosystem — mapping events from major conferences and CTFs to local meetups and community-driven resources — all without pay-to-play marketing.

This partnership is more than symbolic — it’s strategic.

Why It Matters

Together, OWASP and InfoSecMap are working to:

Expand access to global InfoSec events and educational resources
Amplify underrepresented voices and geographies in cybersecurity
Improve visibility and knowledge sharing across borders and disciplines

What This Means for You

Whether you’re a developer in Nairobi, a student in São Paulo, or a security researcher in Chicago, this collaboration gives you better visibility into the global InfoSec landscape — and helps you connect with communities, not just corporations.

You’ll get access to:

Real-time updates on InfoSec events around the world
Local and international OWASP chapter activities
Community-curated resources that reflect a broader, more inclusive view of our industry

This effort is rooted in the belief that open source should also mean open access — and we’re building the infrastructure to make that a reality.

🔗 Explore the new OWASP Hub on InfoSecMap to discover what’s happening in your region — and beyond.

Let’s build the future of cybersecurity together: one that’s open, transparent, and truly global.

OWASP x Google Summer of Code 2025 - Enabling 15 opportunities for impact

Starr Brown — 2025-05-12T07:00:00+00:00

We’re proud to share that OWASP is once again an official mentoring organization for Google Summer of Code (GSoC) 2025—and this year, we’ve secured 15 contributor slots across some of the most impactful open-source security projects in the world.

This milestone reinforces OWASP’s ongoing commitment to open-source innovation and highlights the strength of our global community of mentors and contributors, as well as our commitment to education-by-doing with the GSoC program.

🔧 GSoC 2025: What’s on Deck?

Contributors will get hands-on experience improving and expanding some of OWASP’s most vital tools:

Juice Shop – A globally-used, intentionally insecure web app for security training.
Nettacker – A fast, automated network scanner built for vulnerability detection.
Offensive Web Testing Framework (OWTF) – A smart framework for streamlined penetration testing.
Bug Logging Tool (BLT) – A next-gen bug tracker focused on gamification to incentivize bug and security reporting.
Nest – Core infrastructure to power and enable the OWASP projects and contributors ecosystem.
PyGoat – A Python-based sandbox for learning and exposing security flaws in modern stacks.
OpenCRE – A collaborative cybersecurity knowledge base & reference system.

🚀 What’s Next?

Selected contributors will begin collaborating with mentors to level up these tools and help push open-source security forward.

🙌 Thank You

Huge thanks to our project leads, mentors, contributors, and the OWASP community who made this year’s GSoC application a success. Let’s make this summer one to remember!

— Starr Brown & Fabio Cerullo, OWASP GSoC Admins

OWASP Enables AI Regulation That Works with OWASP AI Exchange

Ricardo Griffith, OWASP Foundation, Global Board Chair — 2025-05-06T07:00:00+00:00

OWASP has forged a coalition between the global security community and formal standardization bodies on AI. The ‘AI Exchange’ Project is now driving the creation of AI security standards that protect people and businesses while still allowing innovation to thrive.

By establishing an official liaison partnership with international standardization organizations, the Open Worldwide Application Security Project (OWASP) has opened the door for its community of 8,500 security professionals to contribute directly to critical standards. This partnership has already made a meaningful impact—especially on key standards for AI security. Thanks to the active involvement of OWASP’s practitioners, the draft standards now include clear, practical, and fair requirements.

The result is a more balanced approach to AI regulation: strong enough to prevent harm to individuals, society, and organizations, but flexible enough to support innovation. The foundation of this approach is risk-based thinking—applying just the right amount of security depending on the context rather than enforcing a one-size-fits-all checklist.

Why AI Security Matters

AI security is now a critical concern for three main reasons:

AI is being connected to everything.
There are many ways to attack AI systems.
Most engineers don’t yet know how to make AI secure.

AI has become an ideal target for attackers. That’s why we urgently need clear guidance and effective regulation.

The Role of OWASP in AI Security Standards

In May 2023, the European Commission launched the development of an AI security standard as part of the AI Act. This standard determines which AI products and services are allowed on the European market. It is being developed by CEN/CENELEC, bringing together committees from 34 European member states and liaison organisations. The results are expected to influence global practices—similar to how the GDPR became a global benchmark (the “Brussels Effect”).

Long-time OWASP contributor Rob van der Veer joined the working group as co-editor and brought the threat model that he developed at the Software Improvement Group and donated to OWASP in 2022. During his work for the AI Act, Rob saw firsthand the urgent need for more hands-on expertise—especially from researchers and practitioners.

To solve this, he founded the OWASP AI Exchange in October 2023 at owaspai.org. This open-source project brings together experts to help shape global standards.

Major Milestones:

OWASP’s official liaison partnership with CEN/CENELEC was approved unanimously by EU member states.
OWASP contributed 70 pages of expert content to ISO/IEC 27090, the global standard on AI security guidance.
40 pages of OWASP contributions were added to the AI Act security standard.
The OWASP AI Exchange was awarded Flagship Project status for these achievements.

A More Open and Inclusive Way to Create Standards

All contributions are based on the 200 pages of open-source material developed by OWASP AI Exchange, available at owaspai.org. This ensures that the expertise shaping international standards is also accessible to all. It promotes alignment across frameworks, tools, and regulatory guidance.

This open approach brings more voices into the standardization process. Experts who are often underrepresented—such as researchers, data scientists, software engineers, startups, and independent contractors—can now help shape global policy.

As of March 7, 2025, the AI Act security standard has completed consultation, generating over 900 comments from member states, liaisons, and the European Commission. The next step is public review, and the OWASP AI Exchange continues to play a substantial role in the process.

“OWASP is excited about our ongoing partnership with CEN and CENELEC,”
— Andrew van der Stock, Executive Director of the OWASP Foundation, Inc.

“With access to our 8,500 members and more than 100,000 participants across our events, chapters, and projects, we look forward to shaping secure software standards for the future.”

What Do Industry Leaders Think?

Dimitri van Zantvliet, Director Cybersecurity, Dutch Railways (NS), said:

“In the railway sector, innovation and safety must go hand in hand. We are increasingly relying on AI to optimize passenger flows, monitor infrastructure, and enhance security. That makes it critical that regulation is both effective and innovation-friendly.
A risk-based, context-aware approach—like the one OWASP champions—not only supports the responsible use of AI, but ensures that real threats are mitigated without burdening engineers with irrelevant checklists. We need standards written by those who build and defend these systems every day.”

Sri Manda, Chief Security & Trust Officer at Peloton Interactive, said:

“AI regulation is critical for protecting safety and security, and for creating a level playing field for vendors. The challenge is to remove legal uncertainty by making standards really clear, and to avoid unnecessary requirements by building in flexible compliance.
I’m very happy to see that OWASP has taken on these challenges by bringing the security community to the table to ensure we get standards that work.”

What’s Next?

OWASP continues to contribute to international standardization efforts including:

OWASP CycloneDX is being advanced as a global standard via ECMA
New collaborations are underway for the Cyber Resilience Act as part of the Open Regulatory Commission Working Group
OpenCRE has been adopted as a central standards hub by the Cloud Security Alliance, major vendors, and Dutch security standards.

Want to Contribute?

Would you like to help shape the future of security standards?

For AI, join the OWASP AI Exchange: https://owaspai.org/contribute/
For other topics, join the OWASP Slack channel: #regulations-and-standards-liaison

OWASP Calls to Build a Unified Framework for Global Vulnerability Intelligence

Steve Springett — 2025-04-17T01:00:00+00:00

In response to increasing concerns over the effectiveness of the CVE Program and the sustainability of the U.S. government’s role in managing the world’s largest vulnerability database, cybersecurity leaders and international stakeholders are coming together to explore a federated model for vulnerability identification. The initiative seeks to address modern security challenges—such as the shift toward hyper-automation, the dominance of open-source software, and emerging needs in cryptography, artificial intelligence, and other specialized domains—by fostering global collaboration and innovation.

The cybersecurity community faces a pivotal moment. Recent reductions in funding for MITRE’s support of the CVE program have sparked widespread concern that the world’s largest vulnerability database can no longer keep pace with the demands of a rapidly evolving global threat landscape. Originally designed for a time when most software was commercial and automation was in its infancy, the CVE program and the National Vulnerability Database (NVD) struggle to meet the needs of an ecosystem increasingly dominated by open-source software. In fact, by some estimates, over 90% of all modern applications rely on open-source components, and yet the CVE program often fails to capture these vulnerabilities quickly or effectively.

These challenges are compounded by emerging cybersecurity needs that extend beyond traditional software vulnerabilities. For example, identifying weaknesses in cryptographic algorithms such as AES-128, which are not “vulnerabilities” in the traditional sense, or documenting cybersecurity issues in AI systems, medical devices, and other complex domains.

In parallel, new trends in cybersecurity have highlighted the limitations of centralized authority. The international community increasingly questions whether any single government or organization can sustainably serve as the sole steward of global vulnerability information. A centralized model, while historically effective, now appears to be a point of weakness, particularly as the breadth and scope of cybersecurity threats expand.

“The shift toward a federated model reflects a growing need for a more agile, community-driven approach. By engaging an international coalition of experts and stakeholders, we can overcome the limitations of centralized systems and deliver a solution that scales with the complexity of today’s software ecosystems,” says Steve Springett, Chair of OWASP CycloneDX and Ecma TC54 and Vice Chair of the OWASP Global Board of Directors.

Exploring a Decentralized Model

The international cybersecurity community must come together to explore a new approach—one that evolves beyond a single, central authority. This is not about “fixing” the CVE Program or the NVD. Instead, it’s a call to action to envision a decentralized model supported by an international coalition.

This model would decentralize responsibility, enabling transparent, scalable, and open sharing of cybersecurity data. It would leverage the expertise of communities already shaping best practices and standards—such as OWASP’s vibrant GenAI and supply chain communities—while encouraging participation from underrepresented sectors, including medical device manufacturers and other industry groups. The goal is to create a flexible, extensible system capable of capturing not only traditional vulnerabilities, but also a broader range of cybersecurity issues, all within a robust and resilient federated structure.

This initiative is in its early stages. There are no answers—yet. But the growing consensus among international stakeholders is clear: we need a modernized, federated approach to cybersecurity records that reflects the complexity, diversity, and global nature of today’s security challenges.

“OWASP has long been at the forefront of advancing open and transparent security standards. This initiative aligns perfectly with our mission to empower the global community to develop secure software. Together, we can redefine how vulnerability intelligence is published and consumed,” states Andrew van der Stock, Executive Director of the OWASP Foundation.

Join Us in Building the Future

We are calling on governments, industry leaders, researchers, and community experts to contribute their voices, expertise, and resources. Together, we can build an alternative model that complements existing efforts, gradually replacing outdated approaches with a federated, community-driven, and international standard.

The future of cybersecurity identification depends on global collaboration. Let’s build it together.

cve@owasp.org

ASVS 5.0 RC1 is ready for your review!

Josh Grossman — 2025-04-09T01:00:00+00:00

Introduction

We are on the final countdown to the release of the OWASP Application Security Verification Standard (ASVS) version 5.0!

This will be a major release with a lot of changes to bring the ASVS up to date and make it more usable. See here for more information on the guiding principles of the new release.

We have now released a release candidate version of 5.0 and we are waiting for your feedback!

How can I help?

Reading through the release candidate version of ASVS is a great place to start. We would strongly recommend that you use the markdown version as we are constantly incorporating updates. There is also a semi-official web based version (maintained by Elar, one of the project leaders) which is kept frequently updated.

A few questions to ask yourself as you review the document:

If I was a developer or a security tester, would this requirement understandable to me?
Can I think of a way of improving front / chapter / section text to add clarity without adding unnecessary content.

Please first log ideas, issues or questions here: https://github.com/OWASP/ASVS/issues. It’s helpful to share if you have any ideas or if you find any bugs or typos (but see the extra guidance below).

We may subsequently ask you to open a pull request, https://github.com/OWASP/ASVS/pulls, based on the discussion in the issue, if you are willing to do so, or we do that ourselves if you prefer.

After familiarizing yourself with the current version and if you don’t have additional questions or feedback, the next area to focus on is the “Issues” section.

The issues to focus on for RC1 are listed here:

https://github.com/OWASP/ASVS/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22_5.0%20-%20rc1%22

What’s next

Our very own Elar Lang, the key driving force behind version 5.0, will be presenting at OWASP Global AppSec EU Barcelona about the final 5.0 version so make sure you check out his session there in the builder track on Friday, 11:30am - 12:15pm.

Stay in contact

Make sure you hear about chapter draft releases and stay in touch via our social media channels and website:

Website: https://asvs.owasp.org
Twitter: https://twitter.com/OWASP_ASVS
LinkedIn: https://www.linkedin.com/company/owasp-asvs/

OWASP Education and Training Committee update

Shruti Kulkarni — 2025-03-06T07:00:00+00:00

Traditionally OWASP offered in-person instructor led trainings as a part of Global AppSec Conferences which take place two or three times a year. However the OWASP Foundation gets requests for more frequent in-person trainings.

OWASP Education and Training Committee has been working on a set of new initiatives and one of them is collaborating with Events Committee to schedule trainings over and above the currently offered trainings in OWASP Global AppSec.

These trainings are aimed at bringing together trainers and students more frequently.

The themes would be builder, breaker, defender and manager, the same as what we currently have for Global AppSecs Conferences.

The process for registering for the trainings is the same as AppSec. Watch out for the upcoming announcements on OWASP website.

The process for making submissions for training is the same as call for trainers (CFT).

Students and organisations: Register and get trained with us to

Enhance your knowledge on application security topics
Meet any compliance requirements that need your developers to be trained on application security
Know more about the latest trends in application security
and many more

The training events will be announced soon. Please visit OWASP website for more information and follow OWASP Foundation on social media.

Advisory on Software Bill of Materials and Real-time Vulnerability Monitoring for Open-Source Software and Third-Party Dependencies

Steve Springett — 2025-02-24T07:00:00+00:00

The OWASP Foundation, in collaboration with the Cyber Security Agency (CSA) of Singapore, presents this advisory on using Software Bill of Materials (SBOM) for enhanced vulnerability management, highlighting OWASP CycloneDX—a format standardized by Ecma International as ECMA-424 —and underscoring OWASP’s joint efforts with both Ecma International and CSA. The advisory also features OWASP Dependency-Track the reference platform for how to consume and analyze SBOMs. For details, including GitHub and GitLab examples and additional references, please see the original advisory published by CSA.

Introduction

The integration of Open-Source Software (OSS) in software development introduces significant cybersecurity challenges, particularly regarding vulnerabilities in third-party dependencies. Notable incidents, such as Log4j and Heartbleed, underscore these risks. On Log4j, many organisations struggled to assess system compromises due to a lack of visibility into their software components and dependencies, with delayed responses to discovered vulnerabilities. On Heartbleed, it affected the widely used OpenSSL cryptography library, leading to the theft of 4.5 million medical records from a major overseas hospital chain.

These dependency threats are exacerbated by extent of third-party dependencies and critical vulnerabilities found in software development projects. According to studies, there are on average 68.81 dependencies per project and 5.12 critical vulnerabilities in an application. If developers are unaware of the full composition of their applications, the risks of cybersecurity breaches are significant. In the light of such trends, there is an impetus for developers to easily identify and address OSS dependencies to mitigate cybersecurity risks.

Intended audience of advisory

The advisory is intended for all software developers, especially those who incorporate OSS and third-party dependencies into their projects. While many developers are aware of cybersecurity risks, they may not have the resources and guidance to enforce cybersecurity during software development and implementation. To aid developers, the advisory offers guidance on a sustainable and automated approach to vulnerability management through Software Bill of Materials (SBOM) and real-time vulnerability monitoring.

Value proposition of SBOM and real-time monitoring of vulnerabilities

The traditional way of manually managing OSS dependencies is inefficient and prone to errors. Furthermore, developers must sift through complex codebases to identify and fix vulnerable software components.

Generating Software Bill of Materials (SBOM) ensures developers are not using known vulnerable dependencies and provide them full visibility into software components. SBOM provides a structured and formal record of components used to build software. It equips organisations with a clear view of their software environment, ensuring that vulnerabilities can be managed more effectively. Through the integration of SBOM tools into software development workflows, developers can automatically track each component from the start, reducing manual effort and human error. It enables them to significantly reduce technical debt by identifying outdated or vulnerable components much earlier, in turn decreasing future remediation workloads.

SBOM also improves response times by allowing developers to quickly identify and fix vulnerable components and collaborate across the organisation for holistic vulnerability management. This streamlined process not only minimises complexity but also fosters collaboration among developers and cybersecurity professionals, allowing cybersecurity risks to be addressed proactively without stifling innovation. If SBOM is integrated into CI/CD pipelines, it allows real-time monitoring of new vulnerabilities through automation of SBOM generation, signing and alerts. The SBOM can also be used to foster collaboration across teams, including SecOps, Incident Response (IR) and development teams for holistic vulnerability management and improved response times.

Three step approach to managing vulnerabilities through SBOMs

Figure 1. Three step approach to managing vulnerabilities through SBOMs

The three-step approach is as follows:

Select tool: The chosen tool should accurately identify and list components as well as direct and indirect dependencies of the software. The tool should also integrate seamlessly with continuous integration/continuous deployment (CI/CD) pipelines such as GitHub Actions, GitLab CI/CD or equivalent software.
Generate and sign the SBOM: The tool should be used to generate an SBOM that complies with industry standards such as CycloneDX or SPDX. Signing the SBOM after its generation ensures authenticity and provides assurance that it originates from a trusted source. Developers should leverage on available tools to publish signed records into transparency logs, enhancing trust and verifiability through immutable records of signing events.
Proactive vulnerability management: The generated SBOM should be published to a secure repository and automatically ingested by tools like OWASP Dependency-Track for continuous vulnerability monitoring and N-day vulnerability identification.

As the software development environment varies for each system, developers should also take note of the following practical considerations:

The SBOM is only as comprehensive as the manifest files generated. If the codebase includes obscure or less common programming languages, some dependencies may not be detected;
For SaaS and closed-source software, developers should request the SBOMs from their third-party providers as these SBOMs provide the most comprehensive coverage of the software components and dependencies. If developers are unable to obtain SBOMs from their third-party providers, the selected SBOM generation tool need to be able to perform supplementary checks in the respective environments. In particular, SaaS software could use runtime SBOMs 10 , capturing dynamically loaded or run-time injected components during execution. For closed-source software, binary-based SBOM tools could be used to create an inventory of the software components used. Such tools inspect the compiled binary code, which is the final product of the software. Once developers discover vulnerabilities through the SBOMs, they need to inform their third-party providers to remediate them;
Developers need to verify identified vulnerabilities for exploitability as the vulnerabilities may not be relevant in their software development environments. Without appropriate verification, there could be a high volume of vulnerabilities surfaced through the SBOM and developers risk being overwhelmed with false positives and time spent on subsequent remediation. Developers should start the verification process by using industry filters such as CISA’s Known Exploited Vulnerabilities (KEV) that only alerts on CVEs that are actively exploited. Once the vulnerabilities are filtered, vulnerabilities can be assessed for the likelihood of being exploited through the Exploit Prediction Scoring System (EPSS). After identifying vulnerabilities that are likely to be exploited, they can be prioritised for remediation using Common Vulnerability Scoring Systems (CVSS), which rates the severity of vulnerabilities.

Automating capabilities in code repositories platforms to manage OSS vulnerabilities

Both commercial and Open-Source Software projects commonly rely on open-source dependencies, typically hosted on code repository platforms such as GitHub and GitLab. As central hubs for OSS development, GitHub and GitLab are used by developers who collaborate on projects of varying scope and complexity. Given the widespread use of such code repository platforms, managing vulnerabilities are even more critical for maintaining a secure software ecosystem. Such environments provide automated workflow functionalities on managing vulnerabilities, with automation enabling a seamless integration of security practices into the development process.

Developers should use tools such as GitHub Actions and GitLab CI/CD that allow for the automated creation and vulnerability checking of SBOMs. While SBOM signing is not a native feature, external tools can be integrated into the workflow. Refer to Annex A for the full script that automates these actions for GitHub Actions and a similar workflow can be implemented for GitLab CI/CD (Annex B).

Developers should either remove vulnerable components if the functionalities provided through these components are not crucial or update these components to non-vulnerable versions. Developers should thoroughly test their applications to verify the application works as intended and update the SBOM documentation to record which components were removed and updated. This approach enhances the cybersecurity of the software and protects users from known exploits.

Developers should publish SBOM, its signature and certificate alongside the digital files. This allows downstream users in the software development ecosystem to easily access and verify the SBOM, ensuring that they are working with a secure and authentic version of the software. Users can also leverage the SBOM to continuously monitor for new vulnerabilities.

Real-time monitoring of vulnerabilities through OWASP Dependency-Track

OWASP Dependency Track (DT) provides real-time vulnerability monitoring capabilities through SBOM ingestion and continual checking against current threat intelligence. OWASP Dependency Track (DT) goes beyond basic scanning by incorporating the Exploit Prediction Scoring System (EPSS), allowing developers to prioritise vulnerabilities based on their likelihood of exploitation. Refer to Annex C for more details on the deployment of OWASP DT.

Developers should integrate the OWASP DT tool into CI/CD pipelines for real-time monitoring, consistent automation of SBOM generation and signing, and alerts for new vulnerabilities. Developers should securely store signed SBOM into centralised repositories to support collaboration across teams, including SecOps, Incident Response (IR) and development teams. In addition, developers need to establish governance policies for SBOM storage, access control and lifecycle management in collaboration with their Chief Information Security Officers (CISOs).

Conclusion

SBOMs and real-time monitoring of vulnerabilities provide developers a sustainable and automated approach to address risks posed by Open-Source Software (OSS) and third-party software components, in turn enhancing the cybersecurity posture of the software supply chain. Such an approach allows developers and system owners to have visibility on software components and dependencies and improve response times to address vulnerabilities.

Acknowledgement

This advisory was jointly developed by the Cyber Security Agency of Singapore and OWASP Foundation.

Disclaimer

The information and advice contained in this document is provided "as is" without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by the Cyber Security Agency of Singapore, OWASP Foundation or GitHub. This document shall not be used for advertising or product endorsement purposes.

OWASP Juice Shop leadership changes & contributor recognition

Bjoern Kimminich — 2025-01-29T07:00:00+00:00

OWASP Juice Shop proudly announces long-time contributor Jannik Hollenbach as co-project lead effective immediately! Additionally, we are enhancing and simplifying our contributor engagement & recognition. Read on to learn more about these changes and how you can get involved in the project!

Project Leadership x2

Effective immediately, Jannik Hollenbach joins Bjoern Kimminich as co-project lead of the OWASP Juice Shop. Jannik has been an an active contributor to the project for many years. His achievements include developing the MultiJuicer hosting-platform, building the Hacking Instructor mechanism for our in-app tutorials, and fully re-creating the Score Board in a modern tile-based layout.

Lacking a second project leader was an open topic of OWASP Juice Shop since a new release of the Project Policy in 2021. Not only are we now addressing this compliance issue, but an operational continuity issue as well.

Enhanced contributor engagement

Read on to learn more about our latest steps to enhance the contributor engagement with OWASP Juice Shop for everyone, independent of experience and level of involvement.

Monthly contributor meeting now public

We always considered our Juice Shop Developer Meeeting on Google Meet open for all past, current, and future contributors. But we totally failed to advertise it actively, which changes now:

The Juice Shop Developer Meeting is scheduled every two weeks on Tuesday at 19:00-19:45 CET/CEST. You can find the meeting series on the OWASP Event Calendar. For an invitation to the series, reach out to me via email or a direct message on Slack and include your email address to invite. You can also just hop on spontaneously as we intened to post the Google Meet link on Slack as a reminder shortly before the meeting starts.

Contributor Slack channel

We maintain two public channels on the official OWASP Slack server, first of all the main community channel project-juiceshop for questions, ideas and feedback. Second, the juiceshop-dev channel where CI/CD pipeline and test automation results are posted by bots.

For contributors, we have a dedicated private channel juiceshop-contributors, which you can easily join by pinging @bkimminich or @Jannik in the public main channel or by sending either a direct message. We will, for now, not make this channel public to avoid it getting used by accident for support questions and other topics the project-juiceshop channel is meant for.

Google Summer of Code 2025

Juice Shop successfully participates in GSoC under the OWASP umbrella since 2018. We provide true mentorship to our students, with weekly meetings for the ideation & feedback cycles, and 1:1 sessions on demand for troubleshooting or pair programming. You can find the overview of all our previous projects on our official references page.

In 2025, Juice Shop again promotes several project ideas to prospective students. In addition to the projects proposed by the team, we are open to suggestions of entirely new project ideas. Feel free to pitch yours directly to the listed mentor team!

Please note that the most successful GSoC projects usually come from students who have already contributed to the project before, so if you are interested in GSoC, start contributing now! Make sure to read our Contribution Guidelines and optionally our Codebase 101 for newcomers.

Simplified contributor recognition

With the above leadership and process changes, we are effeectively abandoning the term “Core Team” from our website and repositories. Every contributor should feel like a team member, regardless of their level of involvement. We will continue to publish regular updates of our top contributor diagram based on git-stats into our Hall of Fame:

The top-translators in our CrowdIn project will also continue to be recognized on the Hall of Fame of our main repository.

Repository and GitHub org level admin and maintainer permissions will remain reserved for the project leaders and hand-selected trusted contributors like our former “Core Team” members, top-contributors, and GSoC mentors Timo Pagel & Shubbam Palriwala.

Lifecycle events are part of the secure supply chain

Olle Johansson and Benji Visser — 2024-11-26T07:00:00+00:00

A new OWASP project - Common Lifecycle Enumeration - aims to standardize encodings of product lifecycle events, such as end-of-life, end-of-support and others. The specification will become an ECMA International standard when ready. Read more about this exciting new OWASP project!

Digital products, both hardware and software have a lifecycle that mirrors human life - they are born, grow and develop, and eventually come to an end, just like ourselves. However, there are many more changes in a product’s lifecycle that need to be captured, both for commercial products and open source software. The end-of-life state will affect many users of a product in various ways and needs to be communicated in a way that supports a high degree of automation.

When building a product today, we combine components from a range of upstream vendors and open source projects - a motherboard, operating system, sensors, software libraries and tools. The bill-of-materials (BOM) is a necessary tool to manage both hardware and software during the lifetime of the product. The BOM, when combined with lifecycle events, provides a foundation for automating and proactively managing each product’s lifecycle.

Regulators require product lifecycle management

New regulations, like the recently adopted EU Cyber Resilience Act, enforces a lifecycle management process where manufacturers are obliged to maintain security through the product’s entire lifecycle, from purchasing to decommissioning. This means manufacturers must ensure that the product and all components are secure, kept up-to-date, and free of exploitable vulnerabilities.

The OWASP CycloneDX bill-of-materials standard can cover many aspects of a product, both software and hardware. But one thing that’s been missing is just the lifecycle events, like end-of-support, end-of-life and end-of-sales. For Open Source projects there are similar events covering “LTS release support”, “security fixes only”, “stable” and other variants.

Monitoring the life state of a product or component is essential

A manufacturer needs to be assured that components from upstream vendors and projects are supported, otherwise the manufacturer assumes full responsibility.

A customer, through their IT organization, also wants to be able to plan their inventory and capture this information from all vendors. Products without any support need to be phased out in a controlled and planned way with as few surprises as possible.

Lifecycle management requires a high degree of automation

This exchange of information across the supply chain needs to be both enumerated in a standard format and automatically exchanged. Rest assured that OWASP is working on all fronts here.

The OWASP Common Lifecycle Enumeration (CLE) project is actively working on a standard for capturing these events. This will be part of the effort to standardize OWASP standards in ECMA TC54. The summer of 2024 CycloneDX became an ECMA standard and more is on the way. A new working group, ECMA TC54 TG3, was formed in October 2024 to lead the standardization alongside working groups for the Package URL (PURL) and the Transparency Exchange API.

How OWASP CLE fits into other work

The CLE syntax will be adopted by the OWASP Transparency Exchange API (TEA) working group (also known as “Project Koala”) that creates a standardized set of APIs for publishing and consuming software and hardware transparency artifacts like SBOM, HBOM, VEX/CSAF vulnerability information, IN-Toto attestations, SCITT statements and much more. With TEA the interaction between customers and vendors will be highly automated. A standard API leads not only to efficient workflows, but also keeps costs for integration under control. Many vendors of platforms have shown interest in integration TEA into their systems, including OWASP Dependency Track, a leading open source platform for software transparency, license compliance and vulnerability management.

If you’re interested, all are welcome to join the work in the OWASP common lifecycle enumeration project!

https://owasp.org/www-project-common-lifecycle-enumeration/

Benji Visser
Leader of OWASP CLE

Olle E. Johansson
Leader of OWASP CycloneDX project Koala