OWASP Developer Guide

Repository on GitHub, which provides public git repositories with URLs: https://github.com/OWASP/www-project-developer-guide

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made: https://github.com/OWASP/www-project-developer-guide/commits/main/ Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The documented release process requires interim versions, or release candidates, for review between releases : https://github.com/OWASP/www-project-developer-guide/blob/main/release-process.md

Repository on GitHub, which uses git. git is distributed.

The developer guide uses semver (semantic versioning) for its versioning system, as seen in the release area: https://github.com/OWASP/www-project-developer-guide/releases

git tags are used to identify the release versions (and release candidates) of the developer guide: https://github.com/OWASP/www-project-developer-guide/tags

They are not released as separate files, but are added to the release area itself in the description for each release as text tailored for the individual release, for example: https://github.com/OWASP/www-project-developer-guide/releases/tag/4.1.3

So far no publicly known vulnerabilities or even publicly unknown ones There is a security policy process for raising security issues with the project : https://github.com/OWASP/www-project-developer-guide/blob/main/security.md

github supplied issue tracker: https://github.com/OWASP/www-project-developer-guide/issues

Yes, GitHub issue tracker provides this : https://github.com/OWASP/www-project-developer-guide/issues

issues and bugs are responded to: https://github.com/OWASP/www-project-developer-guide/issues

the large majority of issues are closed with a few months: https://github.com/OWASP/www-project-developer-guide/issues?q=is%3Aissue+is%3Aclosed

Yes, GitHub issue tracker provides a publicly available archive for issues and responses : https://github.com/OWASP/www-project-developer-guide/issues

there is a security policy process in place: https://github.com/OWASP/www-project-developer-guide/blob/main/security.md

the security policy process provides this using the GitHub security advisories feature: https://github.com/OWASP/www-project-developer-guide/security/advisories/new

no vulnerability reports received yet, but the project leaders have state dthat they will fix any as a priority: https://github.com/OWASP/www-project-developer-guide/blob/main/security.md

The release pipeline rebuilds the web document, along with PDF and eBook files. The pull-request pipeline provides PDF and eBook files, the commit pipeline rebuilds the web document.

github actions within the pipelines are used to build the web document, as well as PDF and eBook files https://github.com/OWASP/www-project-developer-guide/tree/main/.github/workflows

all github workflow actions used by the pipelines are FLOSS

There is no running application that an automated test suit can scan The automated tests applied by the pipelines are link checks, spell checks and markdown lint

The automated tests applied by the pipelines (link checks, spell checks and markdown lint) are invoked in a standard way from the command line or from a github action. This is done on both pull request and commit: https://github.com/OWASP/www-project-developer-guide/blob/main/.github/workflows/ci.yaml https://github.com/OWASP/www-project-developer-guide/blob/main/.github/workflows/pr.yaml

The automated tests applied by the pipelines (link checks, spell checks and markdown lint) are applied to all markdown source files

The automated tests (checks, spell checks and markdown lint) are applied as part of the continuous integration pipelines for pull-request, commit, release and nightly: https://github.com/OWASP/www-project-developer-guide/blob/main/.github/workflows/pr.yaml https://github.com/OWASP/www-project-developer-guide/blob/main/.github/workflows/ci.yaml https://github.com/OWASP/www-project-developer-guide/blob/main/.github/workflows/release.yaml https://github.com/OWASP/www-project-developer-guide/blob/main/.github/workflows/housekeeping.yaml

There is no running application that can have functional / unit test applied by an automated test suite Automated tests are applied on pull-requests to check new contributions.

There is no running application that can have functional / unit test applied by an automated test suite. Automated tests are applied on pull-requests, commit to main branch and nightly CI pipelines

The pull request template advises the contributor that the automated tests will be run on the pull-request

The markdown linter is used to detect code quality errors and common simple mistakes. The linter is FLOSS

Warnings from the link checker, markdown linter and spellchecker are treated as errors, and must be addressed before the pipeline can complete successfully

The markdown linter is strict, where practical, using configuration file .markdownlint.yaml : https://github.com/OWASP/www-project-developer-guide/blob/main/.markdownlint.yaml

The OWASP Developer Guide is a documentation project on how to design secure software. The leaders and contributors therefore have extensive knowledge on how to design secure software.

The OWASP Developer Guide is a documentation project that covers common kinds of errors that lead to vulnerabilities. The leaders and contributors therefore have this knowledge to be able to write the Developer Guide.

The OWASP Developer Guide is a documentation project with no cryptographic functionality

The OWASP Developer Guide is a documentation project with no cryptographic functionality

The OWASP Developer Guide is a documentation project with no cryptographic functionality

The OWASP Developer Guide is a documentation project with no cryptographic security mechanisms

The OWASP Developer Guide is a documentation project with no cryptographic security mechanisms

The OWASP Developer Guide is a documentation project with no cryptographic security mechanisms

The OWASP Developer Guide is a documentation project with no cryptographic security mechanisms

The OWASP Developer Guide is a documentation project with no storage of passwords

The OWASP Developer Guide is a documentation project with no cryptographic security mechanisms

The web document is accessed via https

The OWASP Developer Guide is a documentation project with no cryptographic hash es being used

No security vulnerabilities of medium or higher severity, or of any priority, have been raised against this project

There is a security policy process for raising security issues with the project, and the leaders undertake to fix any security vulnerabilities as a priority : https://github.com/OWASP/www-project-developer-guide/blob/main/security.md

there are no credentials of any sort (test or otherwise) in the repo

This is a documentation project written in markdown for a Jekyll server. Static code analysis is provided by a markdown linter that is run by a nightly pipeline as well as on pull-request and commits to the main branch.

The static code analysis provided by the markdown linter looks for common vulnerabilities in markdown. There is also a spell-checker and a link-checker that are run on a nightly basis as well as on commit and pull-request

There is a security policy process for raising security issues with the project, and the leaders undertake to fix any security vulnerabilities as a priority : https://github.com/OWASP/www-project-developer-guide/blob/main/security.md

Static code analysis is provided by a markdown linter that is run by a nightly pipeline as well as on pull-request and commits to the main branch.

The OWASP Developer Guide is not an application that runs dynamically, it is a web document that is browsed as part of the OWASP web site: https://owasp.org/www-project-developer-guide/release/

There is no C/C++ code or any other memory-unsafe language used for the Developer Guide

So far no publicly known medium and higher severity exploitable vulnerabilities or even low ones There is a security policy process for raising security issues with the project, and the leaders undertake to fix any security vulnerabilities as a priority : https://github.com/OWASP/www-project-developer-guide/blob/main/security.md