Every check we write
What each test proves, and which requirement it proves.
Four, for now. On 25 October we stopped writing every check we couldn’t show failing when the protection it guards is removed. The others come back one at a time, each once it has been proved against a real app. Until then they aren’t written, and they aren’t listed here.
The four
Each one proves a single requirement of OWASP ASVS 5.0.0. Webhook checks are the exception. ASVS has none for them, so they follow the sender’s own docs.
- CheckASVS 5.0.0What it means
- Refuses a request with no credentials—A call along a line from someone not signed in is turned away.
- Refuses a webhook with no signatureSender’s docsA fake “payment succeeded” sent to my payment route is turned away.
- Sends a logged-out visitor away—Someone not signed in is sent to log in instead of seeing the page.
- Doesn’t welcome a site just because it asked—My app doesn’t repeat back the address of whatever site sent a request. App-wide.
Levels
L1 is the baseline every app is measured against. L2 adds requirements for apps holding more sensitive data. The level is what decides which checks are in each plan.
What a check can’t show
Each of these proves one narrow thing. Four of them passing is four facts, not a verdict on your app, and we’ll never add them up into one.