OWASP ASVS
Profile name: owasp-asvs
The OWASP Application Security Verification Standard (ASVS) is a detailed catalogue of application-security controls. It has 14 chapters covering architecture, authentication, session management, access control, input validation, cryptography, error handling, data protection, comms security, malicious code, business logic, files and resources, API and web service, and configuration.
Coverage
Vulkro maps findings to L1 and L2 controls across V1-V14. It does not evaluate L3 (high-assurance) controls. Those need manual attestation, which is outside the scope of a static scanner.
Run it
vulkro compliance . --profile owasp-asvs
vulkro scan . --profile owasp-asvs --format json
The compliance command evaluates each control. The scan --profile form
tags each finding with its relevant controls inline.
High-traffic mappings
| Vulkro finding category | ASVS controls |
|---|---|
BrokenAuthentication | V2.1, V2.2, V2.7 |
BrokenObjectLevelAuth (IDOR) | V4.1, V4.2 |
MassAssignment | V5.1.5 |
Injection | V5.3.4, V5.3.5 |
XSS / SSTI | V5.3.3 |
CSRF | V13.2.3 |
Hardcoded secret | V2.10.4, V14.4 |
Weak crypto | V6.2 |
Session fixation | V3.2 |
SecurityMisconfiguration | V14.1, V14.4 |
Audit packaging
For an audit handoff:
vulkro report . --profile owasp-asvs -o asvs-report.html
This produces a single-page HTML report with per-control pass/fail status,
citations, and timestamped scan provenance. For PDF, use --format pdf
(requires wkhtmltopdf).