OWASP ASVS
The owasp-asvs profile maps findings to the OWASP Application Security Verification Standard controls a code scan can give evidence for. It is the default profile.
vulkro compliance . --profile owasp-asvs
vulkro report . --profile owasp-asvs -o asvs-report.html
The report is a single HTML page with per-control status and the findings behind it. Open it in a browser and print to PDF if you need one.
Controls
| Control | What fails it |
|---|---|
| V2.1 Auth verification | An endpoint with no detectable auth middleware, decorator or guard |
| V4.1 Access control | An id-shaped path parameter with no ownership check (BOLA), or an admin-shaped path with no role check (BFLA) |
| V4.2 Object property authz | Mass assignment, or responses that expose more fields than needed |
| V5.1 Input validation | Raw request bodies used without a schema, or untyped input spread into ORM objects |
| V8.3 Sensitive data | API keys, JWT secrets, private keys or database passwords in source |
| V11.1 Business logic | Signup, password reset, payment, transfer or OTP flows with no anti-automation control |
| V12.5 Outbound controls | Outbound HTTP calls whose URL includes user input (SSRF) |
| V13.2 API inventory | Unversioned endpoints, deprecated routes still mounted, shadow API duplicates (warns) |
| V14.2 Dependency mgmt | An installed package version that matches a known advisory |
Controls that need manual attestation, including all L3 controls, are out of scope.
See also: Compliance overview