Anthropic-Cybersecurity-Skills/skills/performing-web-application-vulnerability-triage/references/standards.md

Standards - Web Application Vulnerability Triage

Primary Standards

OWASP Risk Rating Methodology

• URL: https://owasp.org/www-community/OWASP_Risk_Rating_Methodology
• Purpose: Structured approach to evaluating likelihood and impact of web vulnerabilities

OWASP Top 10 (2021)

• URL: https://owasp.org/www-project-top-ten/
• Categories: A01 through A10 covering the most critical web application security risks

OWASP Web Security Testing Guide v4.2

• URL: https://owasp.org/www-project-web-security-testing-guide/
• Relevance: Manual validation techniques for scanner findings

CWE/SANS Top 25 Most Dangerous Software Weaknesses

• URL: https://cwe.mitre.org/top25/
• Relevance: Maps findings to common weakness enumeration for categorization

CVSS v3.1 / v4.0

• URL: https://www.first.org/cvss/
• Relevance: Industry standard vulnerability scoring complementing OWASP risk rating

Scanner References

Tool	Type	Documentation
OWASP ZAP	DAST	https://www.zaproxy.org/docs/
Burp Suite	DAST	https://portswigger.net/burp/documentation
Semgrep	SAST	https://semgrep.dev/docs/
SonarQube	SAST	https://docs.sonarqube.org/
Snyk Code	SAST	https://docs.snyk.io/scan-with-snyk/snyk-code