# WRNexusJS Security Control Map — OWASP ASVS 5.0.0

This is a framework-control map, not an ASVS certification of applications built with WRNexusJS. Application authorization, business logic, deployment, infrastructure, and operational controls must still be verified for each deployment.

The canonical requirement identifiers come from the [OWASP ASVS 5.0.0 release](https://github.com/OWASP/ASVS/tree/v5.0.0/5.0). Run `bun run security:asvs` to verify that this governed map and its evidence files remain present, and run `wrnexus security audit`, `wrnexus security headers`, and `wrnexus security test` for an application-level baseline.

| Framework control                                                | ASVS 5.0.0 requirements                        | Implementation evidence                  | Verification evidence                          |
| ---------------------------------------------------------------- | ---------------------------------------------- | ---------------------------------------- | ---------------------------------------------- |
| Contextual HTML, attribute, JavaScript, and JSON output encoding | `v5.0.0-1.1.2`, `v5.0.0-1.2.1`, `v5.0.0-1.2.3` | `packages/compiler/src/codegen.ts`       | `packages/compiler/test/compiler.test.ts`      |
| Parameterized database operations                                | `v5.0.0-1.2.4`                                 | `packages/db/src/query.ts`               | `packages/db/test/bunsql-placeholders.test.ts` |
| SSRF allowlists and private-network blocking                     | `v5.0.0-1.3.6`                                 | `packages/security/src/url.ts`           | `packages/security/test/security.test.ts`      |
| Secure, HttpOnly, SameSite cookie defaults                       | `v5.0.0-3.3.1`, `v5.0.0-3.3.2`, `v5.0.0-3.3.4` | `packages/security/src/cookies.ts`       | `packages/security/test/security.test.ts`      |
| HSTS and restrictive response headers                            | `v5.0.0-3.4.1`                                 | `packages/core/src/headers.ts`           | `packages/core/test/headers.test.ts`           |
| Explicit CORS origins                                            | `v5.0.0-3.4.2`                                 | `packages/core/src/headers.ts`           | `packages/core/test/headers.test.ts`           |
| CSP frame protection and per-response nonces                     | `v5.0.0-3.4.6`                                 | `packages/core/src/headers.ts`           | `packages/core/test/headers.test.ts`           |
| CSRF tokens for unsafe requests                                  | `v5.0.0-3.5.1`                                 | `packages/core/src/csrf.ts`              | `packages/core/test/csrf.test.ts`              |
| External redirect allowlists                                     | `v5.0.0-3.7.2`                                 | `packages/security/src/url.ts`           | `packages/security/test/security.test.ts`      |
| Secret masking in diagnostics and logs                           | `v5.0.0-16.2.5`                                | `packages/security/src/serialization.ts` | `packages/security/test/security.test.ts`      |
| Authentication and authorization security events                 | `v5.0.0-16.3.1`, `v5.0.0-16.3.2`               | `packages/auth/src/engine.ts`            | `packages/auth/test/engine.test.ts`            |

Controls including tenant policy, API-key lifecycle, malware-engine integration, and application-specific authorization remain application/deployment responsibilities. The CLI reports framework defaults and detectable unsafe configuration; it does not claim full ASVS conformance.
