The OWASP Application Security Verification Standard (ASVS) provides a testable foundation for designing, building, and assessing secure web applications and services.
A security specification, not a risk list
ASVS is an open standard of concrete security requirements for web applications and web services. Teams can use the same requirements to define acceptance criteria, guide secure development, structure testing, and record verification evidence.
Unlike the OWASP Top 10, which builds awareness around broad risk categories, ASVS describes what should be verified. It gives product owners, developers, architects, and security testers a shared vocabulary for deciding whether a control is present and effective.
Risk-based assurance
The levels are cumulative: Level 2 includes every applicable Level 1 requirement, and Level 3 includes every applicable requirement from Levels 1 and 2. Choose the target from business impact, data sensitivity, exposure, and threat model.
The minimum set of essential application-security controls. A practical entry point for lower-risk applications and teams beginning a structured verification program.
Use it to establish a baseline—not as proof that all relevant risks have been addressed.
A comprehensive target for applications containing sensitive data or supporting important business processes. It addresses most common software risks.
Recommended for most production web applications and APIs.
The highest assurance target for critical or high-value applications where compromise could cause severe financial, safety, privacy, or operational harm.
Expect deeper architecture analysis, stronger controls, and more rigorous evidence.
345 testable statements
ASVS 5.0.0 groups its requirements into 17 chapters. Each identifier follows chapter.section.requirement. Include the version when citing one—for example, v5.0.0-1.2.5.
From standard to evidence
Identify the application, APIs, trust boundaries, data, user roles, integrations, and deployment environment.
Use risk and business impact to select L1, L2, or L3. Document components that need a higher target.
Review every requirement at the target level and record a defensible reason for anything that does not apply.
Combine architecture review, code review, configuration inspection, automated checks, and manual security testing.
Track failed requirements to closure and retain evidence against the versioned ASVS identifier.
Command line automation
Run the selected ASVS level against the Magento project to collect repeatable evidence and surface requirements that need technical or manual review.
Automated checks support an ASVS assessment; they do not verify every applicable requirement or replace architecture, code, and manual security testing.
$ php magebean.phar --path=/var/www/magento --profile=asvs-l1
Profile: OWASP ASVS 5.0 Level 1
Baseline: Magento Production
Automated verification complete
101 checks completed
86 passed
11 need attention
4 high-priority findingsUse the stable OWASP release as the source of truth for formal scope, requirement wording, levels, and applicability.