From “Secure” to “Verified”: I Built an OWASP ASVS Learning Site
The login works, the pages load, and the API responds as expected. Can we say the application is secure?
Security is difficult to judge by intuition alone. We need criteria that help us explain which requirements we checked, what tests we ran, and what evidence supports the results. That is why I spent time exploring OWASP ASVS and turned what I learned into a small learning site.
ASVS stands for the Application Security Verification Standard. Maintained by the Open Worldwide Application Security Project (OWASP), it organizes security requirements that can be checked throughout the design, development, and testing of web applications and services. The site is based on the stable ASVS 5.0.0 release. Official OWASP ASVS project
Learning the standard one lesson at a time
Reading a security standard closely is valuable, but a long document full of requirement identifiers can make it hard to know where to begin. Rather than simply reproducing the source text, I wanted to start with familiar development situations and introduce the ideas and checks step by step.
The lessons move from ASVS fundamentals through input validation and injection, authentication and sessions, authorization, JWT, OAuth and OIDC, browser, API and file handling, cryptography and data protection, configuration and logging, and finally gathering verification evidence. The site includes:
- 10 lessons covering the core topics
- 30 examples connecting concepts to practical situations
- 20 quizzes with answers and explanations
- A guide to the structure of all 17 ASVS chapters, with links to the official text
- Learning guidance that connects the material to different work areas and roles
The goal is not just to pick the right answer. Each quiz explains why an answer is correct and what someone might check in practice. After a lesson, learners can follow the related requirements and think about how to record test results and evidence.
From “I read it” to “I verified it”
One distinction mattered to me throughout this project: learning is not the same as verification. Reading a lesson or completing a quiz does not make a service secure. We still need to choose requirements that fit the system, run the tests, and record the results and supporting evidence.
That is why I did not want the site to stop at “I learned a security concept.” If you review a login flow, follow that work into the requirements for authentication and session management. If you examine API authorization, record whether a test confirmed that one user cannot access another user’s data. The aim is to connect learning with real verification work.
This site is an unofficial learning resource; it is neither operated nor certified by OWASP. An official Korean translation of ASVS 5.0.0 is also available. The site’s explanations and examples can help introduce the concepts, while the official document remains the reference for the exact requirements. OWASP ASVS project and translation information · ASVS 5.0.0 Korean PDF
After building the site
This project reminded me that reading a standard and turning it into a learning path someone else can follow are two different tasks. The first step becomes easier when the material is broken into smaller ideas, grounded in examples, and paired with questions that help learners check their understanding.
If we want to make “it’s secure” a more concrete statement, we can start by asking what we checked and what evidence we have. I hope this site helps people who are new to ASVS take that first step.
ASVS Together: Open the learning site