├── .github ├── dependabot.yml └── workflows │ └── validate-owasp-metadata.yaml ├── .gitignore ├── 404.html ├── Gemfile ├── README.md ├── _config.yml ├── assets └── images │ └── README.md ├── document ├── CODE-001-Secure-Development-Environment.md ├── CODE-002-Hardcoded-Secrets-Detection.md ├── CODE-003-Manual-Secure-Code-Review.md ├── CODE-004-Static-Application-Security-Testing-SAST.md ├── CODE-005-Software-Composition-Analysis-SCA.md ├── CODE-006-Software-License-Compliance.md ├── CODE-007-Inline-IDE-Secure-Code-Analysis.md ├── CODE-008-Container-Security-Scanning.md ├── CODE-009-Secure-Dependency-Management.md ├── DES-001-Secure-Architecture-Design-Reviews.md ├── DES-002-Threat-Modelling.md ├── OPR-001-Environment-Hardening.md ├── OPR-002-Application-Hardening.md ├── OPR-003-Environment-Security-Logging.md ├── OPR-004-Application-Security-Logging.md ├── OPR-005-Responsible-Disclosure.md ├── OPR-006-Certificate-Management.md ├── OPR-007-Attack-Surface-Management.md ├── ORG-001-Risk-Assessment.md ├── ORG-002-Security-Training.md ├── ORG-003-Security-Champion.md ├── ORG-004-Security-Reporting.md ├── REL-001-Artifact-Signing.md ├── REL-002-Secure-Artifact-Management.md ├── REL-003-Secret-Management.md ├── REL-004-Secure-Configuration.md ├── REL-005-Security-Policy-Enforcement.md ├── REL-006-Infrastructure-as-Code-Secure-Deployment.md ├── REL-007-Compliance-Scanning.md ├── REL-008-Secure-Release-Management.md ├── REQ-001-Security-Policy-and-Regulatory-Compliance.md ├── REQ-002-Security-Requirements-and-Standards.md ├── REQ-003-Security-User-Stories-and-Acceptance-Criteria.md ├── REQ-004-Security-Issues-Tracking.md ├── TEST-001-Security-Test-Management.md ├── TEST-002-Dynamic-Application-Security-Testing-DAST.md ├── TEST-003-Interactive-Application-Security-Testing-IAST.md ├── TEST-004-Penetration-Testing.md ├── TEST-005-Security-Test-Coverage.md └── images │ ├── azure.svg │ ├── github.svg │ ├── gitlab.svg │ ├── linkedin.svg │ ├── logo.svg │ └── slack_logo.png ├── index.md ├── info.md ├── leaders.md ├── project.owasp.yaml ├── tab_contributing.md ├── v1.1 └── DevSecOps-VerificationStandard-v1.1.xlsx └── v1 └── DevSecOps-VerificationStandard-v1.xlsx /.github/dependabot.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/.github/dependabot.yml -------------------------------------------------------------------------------- /.github/workflows/validate-owasp-metadata.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/.github/workflows/validate-owasp-metadata.yaml -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/.gitignore -------------------------------------------------------------------------------- /404.html: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/404.html -------------------------------------------------------------------------------- /Gemfile: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/Gemfile -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/README.md -------------------------------------------------------------------------------- /_config.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/_config.yml -------------------------------------------------------------------------------- /assets/images/README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/assets/images/README.md -------------------------------------------------------------------------------- /document/CODE-001-Secure-Development-Environment.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/CODE-001-Secure-Development-Environment.md -------------------------------------------------------------------------------- /document/CODE-002-Hardcoded-Secrets-Detection.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/CODE-002-Hardcoded-Secrets-Detection.md -------------------------------------------------------------------------------- /document/CODE-003-Manual-Secure-Code-Review.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/CODE-003-Manual-Secure-Code-Review.md -------------------------------------------------------------------------------- /document/CODE-004-Static-Application-Security-Testing-SAST.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/CODE-004-Static-Application-Security-Testing-SAST.md -------------------------------------------------------------------------------- /document/CODE-005-Software-Composition-Analysis-SCA.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/CODE-005-Software-Composition-Analysis-SCA.md -------------------------------------------------------------------------------- /document/CODE-006-Software-License-Compliance.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/CODE-006-Software-License-Compliance.md -------------------------------------------------------------------------------- /document/CODE-007-Inline-IDE-Secure-Code-Analysis.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/CODE-007-Inline-IDE-Secure-Code-Analysis.md -------------------------------------------------------------------------------- /document/CODE-008-Container-Security-Scanning.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/CODE-008-Container-Security-Scanning.md -------------------------------------------------------------------------------- /document/CODE-009-Secure-Dependency-Management.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/CODE-009-Secure-Dependency-Management.md -------------------------------------------------------------------------------- /document/DES-001-Secure-Architecture-Design-Reviews.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/DES-001-Secure-Architecture-Design-Reviews.md -------------------------------------------------------------------------------- /document/DES-002-Threat-Modelling.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/DES-002-Threat-Modelling.md -------------------------------------------------------------------------------- /document/OPR-001-Environment-Hardening.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/OPR-001-Environment-Hardening.md -------------------------------------------------------------------------------- /document/OPR-002-Application-Hardening.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/OPR-002-Application-Hardening.md -------------------------------------------------------------------------------- /document/OPR-003-Environment-Security-Logging.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/OPR-003-Environment-Security-Logging.md -------------------------------------------------------------------------------- /document/OPR-004-Application-Security-Logging.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/OPR-004-Application-Security-Logging.md -------------------------------------------------------------------------------- /document/OPR-005-Responsible-Disclosure.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/OPR-005-Responsible-Disclosure.md -------------------------------------------------------------------------------- /document/OPR-006-Certificate-Management.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/OPR-006-Certificate-Management.md -------------------------------------------------------------------------------- /document/OPR-007-Attack-Surface-Management.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/OPR-007-Attack-Surface-Management.md -------------------------------------------------------------------------------- /document/ORG-001-Risk-Assessment.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/ORG-001-Risk-Assessment.md -------------------------------------------------------------------------------- /document/ORG-002-Security-Training.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/ORG-002-Security-Training.md -------------------------------------------------------------------------------- /document/ORG-003-Security-Champion.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/ORG-003-Security-Champion.md -------------------------------------------------------------------------------- /document/ORG-004-Security-Reporting.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/ORG-004-Security-Reporting.md -------------------------------------------------------------------------------- /document/REL-001-Artifact-Signing.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REL-001-Artifact-Signing.md -------------------------------------------------------------------------------- /document/REL-002-Secure-Artifact-Management.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REL-002-Secure-Artifact-Management.md -------------------------------------------------------------------------------- /document/REL-003-Secret-Management.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REL-003-Secret-Management.md -------------------------------------------------------------------------------- /document/REL-004-Secure-Configuration.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REL-004-Secure-Configuration.md -------------------------------------------------------------------------------- /document/REL-005-Security-Policy-Enforcement.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REL-005-Security-Policy-Enforcement.md -------------------------------------------------------------------------------- /document/REL-006-Infrastructure-as-Code-Secure-Deployment.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REL-006-Infrastructure-as-Code-Secure-Deployment.md -------------------------------------------------------------------------------- /document/REL-007-Compliance-Scanning.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REL-007-Compliance-Scanning.md -------------------------------------------------------------------------------- /document/REL-008-Secure-Release-Management.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REL-008-Secure-Release-Management.md -------------------------------------------------------------------------------- /document/REQ-001-Security-Policy-and-Regulatory-Compliance.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REQ-001-Security-Policy-and-Regulatory-Compliance.md -------------------------------------------------------------------------------- /document/REQ-002-Security-Requirements-and-Standards.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REQ-002-Security-Requirements-and-Standards.md -------------------------------------------------------------------------------- /document/REQ-003-Security-User-Stories-and-Acceptance-Criteria.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REQ-003-Security-User-Stories-and-Acceptance-Criteria.md -------------------------------------------------------------------------------- /document/REQ-004-Security-Issues-Tracking.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/REQ-004-Security-Issues-Tracking.md -------------------------------------------------------------------------------- /document/TEST-001-Security-Test-Management.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/TEST-001-Security-Test-Management.md -------------------------------------------------------------------------------- /document/TEST-002-Dynamic-Application-Security-Testing-DAST.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/TEST-002-Dynamic-Application-Security-Testing-DAST.md -------------------------------------------------------------------------------- /document/TEST-003-Interactive-Application-Security-Testing-IAST.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/TEST-003-Interactive-Application-Security-Testing-IAST.md -------------------------------------------------------------------------------- /document/TEST-004-Penetration-Testing.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/TEST-004-Penetration-Testing.md -------------------------------------------------------------------------------- /document/TEST-005-Security-Test-Coverage.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/TEST-005-Security-Test-Coverage.md -------------------------------------------------------------------------------- /document/images/azure.svg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/images/azure.svg -------------------------------------------------------------------------------- /document/images/github.svg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/images/github.svg -------------------------------------------------------------------------------- /document/images/gitlab.svg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/images/gitlab.svg -------------------------------------------------------------------------------- /document/images/linkedin.svg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/images/linkedin.svg -------------------------------------------------------------------------------- /document/images/logo.svg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/images/logo.svg -------------------------------------------------------------------------------- /document/images/slack_logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/document/images/slack_logo.png -------------------------------------------------------------------------------- /index.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/index.md -------------------------------------------------------------------------------- /info.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/info.md -------------------------------------------------------------------------------- /leaders.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/leaders.md -------------------------------------------------------------------------------- /project.owasp.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/project.owasp.yaml -------------------------------------------------------------------------------- /tab_contributing.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/tab_contributing.md -------------------------------------------------------------------------------- /v1.1/DevSecOps-VerificationStandard-v1.1.xlsx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/v1.1/DevSecOps-VerificationStandard-v1.1.xlsx -------------------------------------------------------------------------------- /v1/DevSecOps-VerificationStandard-v1.xlsx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-devsecops-verification-standard/HEAD/v1/DevSecOps-VerificationStandard-v1.xlsx --------------------------------------------------------------------------------