OWASP ASVS

Official docs outline

V1 Encoding and Sanitization
Output encoding, injection defenses, sanitization and safe interpreters.
V2 Validation and Business Logic
Input validation, business logic limits, anti-automation and sequence enforcement.
V3 Web Frontend Security
CSP, security headers, cookies, DOM-based attacks and browser protections.
V4 API and Web Service
REST, GraphQL and WebSocket API security requirements.
V5 File Handling
File upload validation, storage, download and path handling.
V6 Authentication
Password security, MFA, lookup secrets and credential recovery requirements.
V7 Session Management
Session token generation, expiry, termination and re-authentication.
V8 Authorization
Access control design, least privilege, object and function-level authorization.
V10 OAuth and OIDC
OAuth 2.0 and OpenID Connect client, authorization server and resource server requirements.
V11 Cryptography
Approved algorithms, key management, randomness and cryptographic inventory.
V12 Secure Communication
TLS configuration, certificate validation and service-to-service communication.
V13 Configuration
Secure build and deploy configuration, secrets handling and dependency management.
V14 Data Protection
Sensitive data classification, minimization, caching and client-side storage.
V15 Secure Coding and Architecture
Secure architecture, dependency risk, safe concurrency and defensive coding.
V16 Security Logging and Error Handling
Security event logging, log protection and error handling requirements.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.