The OWASP AI Security Verification Standard (AISVS) is a community-driven, open-source framework providing a comprehensive set of verifiable security requirements for AI-enabled systems. Modeled after the OWASP Application Security Verification Standard (ASVS), it defines 12 control families (C01-C12) covering the entire AI lifecycle, from training data integrity and model lifecycle management to adversarial robustness and monitoring/logging. The repository is structured as a living standard with two parallel tracks: a locked, stable release (1.0/) and an active development version (1.01-dev/). Each requirement is backed by an extensive research wiki that details the threat landscape, notable incidents, tooling maturity, verification approaches, and open research questions. This makes the AISVS not just a checklist, but a deeply researched knowledge base for engineers, auditors, and security architects building and evaluating AI systems. It also includes appendices for a glossary, a controls inventory, and AI-assisted secure coding practices. Note: This is a documentation/specification repository, not a software application or data science project. Its quality is measured by the rigor of its research, the clarity of its requirements, and the maintainability of its structure.
Nuxt Security is a Nuxt 3+ module that automatically configures applications to follow OWASP security patterns through HTTP headers and middleware. It provides security response headers (including CSP with nonce/hash support for SSR/SSG), request size and rate limiting, XSS validation, CORS support, and optional features like Basic Auth and CSRF protection. The architecture uses Nitro plugins to integrate with Nuxt's server lifecycle, separating concerns between configuration, middleware, build-time plugins, and runtime hooks. The module handles both SSR and SSG modes appropriately, using nonces for CSP in SSR and computed hashes for SSG, with proper strict-dynamic support.
This is the official OWASP Cheat Sheet Series repository, providing concise, actionable security guidance for developers. It contains over 150 markdown cheat sheets covering web application security, cloud security, AI security, and more. The repository is primarily a documentation project but includes a sophisticated build system (MkDocs, Docker, CI/CD) and tooling for quality assurance: markdown linting, link checking, text linting, and automated PR review agents. The link checker is a standout reusable component with modular architecture. The project is actively maintained with strict quality gates and a well-defined contribution process.
This repository is Microsoft's Agent Governance Toolkit, a production-grade multi-language framework (Python, TypeScript, Rust, Go, .NET) for enforcing policy, identity, trust, audit, and sandboxing on autonomous AI agents. In production, it intercepts agent tool calls, messages, and delegations before they reach external services, evaluating them against declarative policies (OPA, Cedar, or custom backends) with deterministic outcomes (allow/deny/escalate/transform). The system provides a full governance plane including a Rust-based policy engine (Agent Control Specification), a service mesh (AgentMesh) with API gateway, trust engine, policy server, and audit collector, a hypervisor for execution rings and sandboxing (Docker, Hyperlight, Nono), compliance verification (OWASP, EU AI Act), SLO monitoring, and a plugin marketplace. Integrations exist for LangChain, CrewAI, AutoGen, OpenAI Agents, Semantic Kernel, MCP, and many other frameworks. The toolkit is deployed as CLI tools (`agt`, `agentmesh`, `agentos`), Docker containers with sidecar patterns, Kubernetes charts, and VS Code/Chrome extensions. The architecture is polyglot with a shared policy engine core written in Rust; the Python SDK is the richest, with the .NET and Go SDKs covering governance middleware and lifecycle management. The codebase is heavily tested with 992 conformance tests across 10 formal specs, fuzzing targets, and CI gates enforcing deterministic policy outcomes, fail-closed behavior, and no-stub registration.
The OWASP Web Security Testing Guide (WSTG) is a comprehensive, community-maintained documentation project defining standard test cases for web application security assessments. It is primarily a structured knowledge base written in Markdown, organized by testing categories including Information Gathering, Authentication, Injection, and API Testing. The repository also serves as the source for multiple derived artifacts: a Jekyll static website (wstg.owasp.org), downloadable PDF/EPUB ebooks via a Pandoc+Typst pipeline, and machine-readable test checklists in JSON, XLSX, and Markdown formats. The build infrastructure includes Python scripts for site generation and navigation, GitHub Actions for CI/CD (linting, link checking, deployment), and a versioned release process that supports multiple channels (latest, stable, past versions). Although the primary content is documentation, the repository functions as a publication platform with significant automation and is actively maintained by a community of contributors. It is not a software application in the traditional sense, but the build tooling and CI/CD pipelines qualify it as an application-focused project with strong data engineering characteristics in its checklist generation and structured content management.
Themis is a cross-platform cryptographic library developed by Cossack Labs, providing high-level security primitives such as Secure Cell (symmetric encryption with three modes: Seal, Token Protect, Context Imprint), Secure Message (asymmetric encryption and digital signing), Secure Session (mutual authentication and key exchange), Secure Comparator (zero-knowledge password comparison), and key generation (EC, RSA, symmetric). The core is implemented in C with a cryptographic engine abstraction layer (Soter) that supports OpenSSL, BoringSSL, and a custom Ed25519 implementation. The library exposes consistent APIs across 13+ language wrappers including Python, Go, Rust, Java, Swift, Objective-C, JavaScript (Node.js and WebAssembly), PHP, Ruby, C++, and React Native. The codebase is well-structured with extensive unit, integration, and fuzz testing, CI/CD pipelines for each wrapper, and cross-language compatibility tests. While the repository has deprecated older APIs and maintains multiple backends, it remains actively maintained with regular releases, security patches, and community engagement.
WebGoat is a deliberately insecure web application designed for security training, providing hands-on lessons for the OWASP Top 10 vulnerabilities. In production, it operates as a Spring Boot monolith with a modular lesson architecture; each lesson is a self-contained endpoint that simulates a real-world vulnerability (SQL injection, XSS, CSRF, JWT misuse, etc.) and validates the user's attack payload. A companion application, WebWolf, acts as attacker infrastructure (file hosting, JWT encoding/decoding, request logging). The system includes user registration, progress tracking via JPA/Flyway with per-user database schemas, and a Thymeleaf/Backbone.js frontend with multilingual support. External dependencies include H2/HSQLDB, Spring Security, AsciiDoc rendering, and intentionally outdated libraries (e.g., jQuery 2.1.4) to demonstrate specific weaknesses. The architecture is well-structured but carries intentional technical debt for educational purposes. The most reusable components are the WebAuthn support utilities (CBOR, COSE, attestation parsing) and the command execution service, both of which demonstrate non-obvious engineering skill and can be extracted independently.
DefectDojo is a Django-based vulnerability management platform that aggregates, deduplicates, and tracks security findings from over 200 security scanners (SAST, DAST, SCA, container, cloud, infrastructure). The system ingests scan reports via a standardized parser interface, normalizes findings into a core data model (Product, Engagement, Test, Finding, Location), and provides advanced features such as risk-based prioritization, SLA management, JIRA/GitHub integration, notifications (Slack, Teams, email), role-based access control, and customizable reporting. The architecture is a Django monolith with a REST API (v2 using DRF, v3 using Ninja in alpha), Celery for async task processing (imports, deduplication, JIRA sync, SLA expiry), PostgreSQL with full-text search and audit logging via pghistory, and a containerized deployment with Docker Compose. Key entry points include the parser factory (dojo/tools/factory.py), API viewsets, and management commands. The codebase demonstrates strong software engineering patterns such as a modular parser contract, an abstract location manager for feature-flag-driven migration, and an authorization filter registry, but carries technical debt from a dual API surface and an incomplete migration to a new location model.
SILENTCHAIN AIâ„¢ Community Edition is a Burp Suite extension that performs AI-powered passive vulnerability scanning of HTTP traffic. It intercepts requests/responses through Burp's proxy, sends them to configurable AI providers (Burp AI, Ollama, OpenAI, Claude, Gemini, Azure), and generates OWASP Top 10 vulnerability findings. The extension features a modular architecture with a thread pool for background AI processing, Swing-based UI integrated into Burp Suite, and persistence for settings via Burp's preferences API. Key capabilities include bidirectional data sanitization to prevent leaking secrets to AI providers, robust JSON parsing for handling LLM output inconsistencies, layered HTTP filtering (scope, content-type, rate limiting, URL deduplication), and real-time UI updates showing findings, task status, and statistics.
OWTF (Offensive Web Testing Framework) is a full-stack web application for automated and manual penetration testing. The Python/Tornado backend exposes a JWT-protected REST API for managing targets, sessions, plugin worklists, workers, reports, and proxy history, while the React/Redux frontend provides dashboards, data tables, plugin marketplace, and proxy controls. The application also includes a customizable intercepting HTTP/HTTPS proxy with SSL certificate generation, an interceptor chain for header/body/URL/delay modification, transaction history, a repeater, and live interception - comparable in scope to a Burp Suite-style tool. Execution is plugin-driven: built-in Python plugins covering web, network, and auxiliary tests, plus wrappers around external tools like Nikto and Arachni, are run by multiprocessing workers. Community plugins can be uploaded after AST-based static validation that blocks dangerous imports and execution patterns. The system stores plugin outputs, deduplicates them via SHA-256 fingerprints, tracks execution metrics, and supports HTML reporting. User authentication includes JWT, email verification, OTP, and admin role management. Architecturally, this is a monolith with modular managers and a REST API, not microservices. Deployment targets Docker Compose, Kubernetes, and cloud Terraform. The codebase contains genuinely reusable components: AST-based plugin validation, cross-platform file locking, output fingerprint deduplication, structured logging, and SQLAlchemy query helpers. However, it also carries significant legacy debt: old frontend patterns (React 16 class components, Redux 3, Redux-Saga 0.16), Python 2 remnants in scripts, hardcoded secrets in compose files, and several stub or placeholder external plugins. The repository is fundamentally an application rather than a data research project; bundled dictionaries and execution metrics serve the security workflow but do not define its primary character.
APKDeepLens is a Python-based CLI static analysis tool for Android APK security assessment. It decompiles APKs using bundled JADX, analyzes AndroidManifest.xml for misconfigurations, scans decompiled source code for OWASP Mobile Top 10 vulnerabilities, detects hardcoded secrets and insecure URLs, and generates reports in JSON/HTML/PDF/TXT formats. The architecture is monolithic with modular components for manifest analysis, code scanning, secret extraction, and report generation. Entry point is APKDeepLens.py with argparse CLI interface. External dependencies include JADX (bundled), xhtml2pdf for PDF generation, and python-bidi for PDF rendering.