ASVS Compliance Engine

Turn Security Requirements into Verifiable Code.

Stop managing security in spreadsheets. The ASVS Compliance Engine is a DevSecOps toolkit that operationalizes the OWASP Application Security Verification Standard (ASVS) 5.0. It treats compliance as code, scanning your infrastructure, verifying your app headers, and enforcing evidence requirements in your CI/CD pipeline.

Get Started · Documentation · Report Bug

⚡ The Problem: Compliance Rot

Most security compliance efforts fail because they rely on static documents (Word/Excel) that become obsolete the moment they are written. This engine bridges the gap between Requirements and Reality.

🚀 Key Features

1. Automated Evidence Verification

Don't just claim you use secure libraries—prove it. Map ASVS requirements directly to files in your repository using evidence.yml. The engine verifies their existence and content during every build.

2. Infrastructure-as-Code (IaC) Scanning

Shift security left by catching cloud storage misconfigurations before they deploy. Our native scanner checks Terraform plans against ASVS V5.3 (Storage & Cryptography).

3. Auditor-Ready Dashboards

Stop manually compiling evidence. Generate a comprehensive HTML report that combines documentation status, code evidence, and DAST results into a single pane of glass for your SOC2/ISO 27001 auditor.

🛠️ Quick Start

Option A: Python (Recommended)

# 1. Install the toolkit
pip install "asvs-compliance-tools[evidence,verification]"

# 2. Initialize your project (Interactive Wizard)
# Generates your security docs and evidence.yml
python -m tools.init_project --interactive

# 3. Verify Compliance
# Scans your docs and code for evidence
python -m tools.compliance_gate --level 2 --evidence-manifest evidence.yml

Option B: Docker

No Python environment? No problem.

# Build the image
docker build -t asvs-engine .

# Run the Compliance Gate
docker run -v $(pwd):/app asvs-engine tools.compliance_gate --level 2

📦 What's Inside?

🤝 Contributing

We are building the standard for open-source compliance.

• Roadmap: See our plans for Jira Sync and VS Code extensions.
• Contributing Guide: How to set up your dev environment.

💖 Support the Project

If this tool saves your team hours of audit preparation, please consider sponsoring the development. Your support funds the creation of pre-built Evidence Packs for frameworks like Django, Spring Boot, and Node.js.

OWASP ASVS •