OWASP OSVS

Overview

OWASP OSVS (Open Source Verification Standard) provides a framework for verifying the security posture of open source components used in software development. It addresses the growing risk of software supply chain attacks by defining requirements for dependency evaluation, vulnerability scanning, license compliance, maintenance assessment, and provenance verification. CodeMiners applies OSVS to evaluate every open source dependency before it enters the codebase.

Governing Body

OWASP Foundation (Open Worldwide Application Security Project)

Scope of Certification

Covers the evaluation and ongoing monitoring of open source software components: known vulnerability scanning, license compliance, maintenance status assessment, contributor reputation, build provenance verification, and dependency update management.

Audit and Assessment Process

Verification is performed through automated tooling integrated into CI/CD pipelines. Tools scan Software Bills of Materials (SBOMs) against vulnerability databases (NVD, OSV, GitHub Advisory), verify license compatibility, and assess component maintenance status. Critical findings block deployment.

Key Requirements

1. Software Bill of Materials (SBOM) for all projects
2. Automated vulnerability scanning against NVD, OSV, and GitHub Advisory databases
3. License compatibility analysis for all dependencies
4. Maintenance and abandonment risk assessment
5. Build provenance and integrity verification
6. Defined SLAs for patching vulnerable dependencies

Compliance Entitlements

• Systematic open source component security verification
• Software supply chain integrity assurance for all dependencies
• Automated vulnerability scanning and license compliance checking
• Protection against supply chain attacks and compromised packages

Client Benefits

• Provides assurance that open source components used in client projects are vetted for security
• Reduces client exposure to supply chain attacks
• Automated verification ensures continuous compliance, not point-in-time checks

Related Certifications