OWASP ASVS

1. V1 Encoding and Sanitization

   Output encoding, injection defenses, sanitization and safe interpreters.

2. V2 Validation and Business Logic

   Input validation, business logic limits, anti-automation and sequence enforcement.

3. V3 Web Frontend Security

   CSP, security headers, cookies, DOM-based attacks and browser protections.

4. V4 API and Web Service

   REST, GraphQL and WebSocket API security requirements.

5. V5 File Handling

   File upload validation, storage, download and path handling.

6. V6 Authentication

   Password security, MFA, lookup secrets and credential recovery requirements.

7. V7 Session Management

   Session token generation, expiry, termination and re-authentication.

8. V8 Authorization

   Access control design, least privilege, object and function-level authorization.

9. V10 OAuth and OIDC

   OAuth 2.0 and OpenID Connect client, authorization server and resource server requirements.

10. V11 Cryptography

    Approved algorithms, key management, randomness and cryptographic inventory.

11. V12 Secure Communication

    TLS configuration, certificate validation and service-to-service communication.

12. V13 Configuration

    Secure build and deploy configuration, secrets handling and dependency management.

13. V14 Data Protection

    Sensitive data classification, minimization, caching and client-side storage.

14. V15 Secure Coding and Architecture

    Secure architecture, dependency risk, safe concurrency and defensive coding.

15. V16 Security Logging and Error Handling

    Security event logging, log protection and error handling requirements.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.