WRNexusJS/docs/SECURITY-ASVS-5.md

WRNexusJS Security Control Map — OWASP ASVS 5.0.0

This is a framework-control map, not an ASVS certification of applications built with WRNexusJS. Application authorization, business logic, deployment, infrastructure, and operational controls must still be verified for each deployment.

The canonical requirement identifiers come from the OWASP ASVS 5.0.0 release. Run bun run security:asvs to verify that this governed map and its evidence files remain present, and run wrnexus security audit, wrnexus security headers, and wrnexus security test for an application-level baseline.

Framework control	ASVS 5.0.0 requirements	Implementation evidence	Verification evidence
Contextual HTML, attribute, JavaScript, and JSON output encoding	v5.0.0-1.1.2, v5.0.0-1.2.1, v5.0.0-1.2.3	packages/compiler/src/codegen.ts	packages/compiler/test/compiler.test.ts
Parameterized database operations	v5.0.0-1.2.4	packages/db/src/query.ts	packages/db/test/bunsql-placeholders.test.ts
SSRF allowlists and private-network blocking	v5.0.0-1.3.6	packages/security/src/url.ts	packages/security/test/security.test.ts
Secure, HttpOnly, SameSite cookie defaults	v5.0.0-3.3.1, v5.0.0-3.3.2, v5.0.0-3.3.4	packages/security/src/cookies.ts	packages/security/test/security.test.ts
HSTS and restrictive response headers	v5.0.0-3.4.1	packages/core/src/headers.ts	packages/core/test/headers.test.ts
Explicit CORS origins	v5.0.0-3.4.2	packages/core/src/headers.ts	packages/core/test/headers.test.ts
CSP frame protection and per-response nonces	v5.0.0-3.4.6	packages/core/src/headers.ts	packages/core/test/headers.test.ts
CSRF tokens for unsafe requests	v5.0.0-3.5.1	packages/core/src/csrf.ts	packages/core/test/csrf.test.ts
External redirect allowlists	v5.0.0-3.7.2	packages/security/src/url.ts	packages/security/test/security.test.ts
Secret masking in diagnostics and logs	v5.0.0-16.2.5	packages/security/src/serialization.ts	packages/security/test/security.test.ts
Authentication and authorization security events	v5.0.0-16.3.1, v5.0.0-16.3.2	packages/auth/src/engine.ts	packages/auth/test/engine.test.ts

Controls including tenant policy, API-key lifecycle, malware-engine integration, and application-specific authorization remain application/deployment responsibilities. The CLI reports framework defaults and detectable unsafe configuration; it does not claim full ASVS conformance.