OWASP Cornucopia project

OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams Identify security requirements in Agile, conventional, and formal development processes. It is language, platform, and technology agnostic. Visit: https://cornucopia.owasp.org/

The cross-references on the Web App Edition deck relate to the following versions of other OWASP and external resources:

Standards

• OWASP Artificial Intelligence Security Verification Standard v1.0 (AISVS)
• OWASP Application Security Verification Standard (ASVS) v4 (2019) and v5 (2025)
• OWASP Mobile Application Security Verification Standard (MASVS) v2.1

Maturity Models

• OWASP DSOMM
• OWASP SAMM

Top 10:

• OWASP Agentic Top 10
• OWASP LLM Top 10
• OWASP Top 10
• OWASP Top 10 Client-Side Security Risks

Guides

• OWASP Automated Threats to Web Applications
• OWASP AI Testing Guide
• OWASP Mobile Application Security Testing Guide (MASTG) v1.7

Other sources:

• Mitre ATT&CK
• Mitre Atlas™
• Mitre CAPEC™ v3.9
• OWASP Dev Guide Web Application Checklist
• SAFECode Practical Security Stories and Security Tasks for Agile Development Environments (SAFECode) July 2012
• STRIDE
• PHANTOM-B

Contributing to Development

Large binary files

This repository stores deck templates and artwork in Git LFS. Install Git LFS before cloning so Git replaces LFS pointers with the actual files during checkout.

Install it from https://git-lfs.com/, then run these commands in PowerShell, Command Prompt, macOS Terminal, or an Ubuntu shell:

git lfs install
git clone https://github.com/OWASP/cornucopia.git
cd cornucopia
git lfs pull
git lfs fsck

git lfs install installs Git LFS checkout hooks, which automatically hydrate tracked assets after future clone, checkout, pull, and merge operations. git lfs pull repairs an existing clone created before Git LFS was installed. git lfs fsck verifies the locally checked out LFS objects.

Git does not run repository-provided setup code during clone, so each developer must install Git LFS once. The command above is supported by Windows, macOS, and Ubuntu wherever Git is installed.

Git tracks executable permissions for the shell scripts used by CI and Copi. Ubuntu and macOS restore these modes automatically from the repository index. Batch files are checked out with CRLF line endings for Windows; Windows does not use POSIX executable permissions for .bat files.

Using Scripts to develop and build Cornucopia

Scripts to build the Cornucopia Card Decks

Please read README.md

Additional Utility Scripts

Please read README.md

Security Scanning

First time setup:

pip install pre-commit
pre-commit install

A Bandit pre-commit hook scans Python scripts for security issues on commit. It runs automatically via pre-commit (medium severity, high confidence).

To run manually:

pre-commit run bandit --all-files

Building and Deploying the Cornucopia website

https://cornucopia.owasp.org contains the card browser for each of the cards in the cornucopia suits together with the taxonomy and in depth explaination for each of the cards in the suits.

please read README.md

Building and Deploying the Cornucopia Game Engine: Copi

Copi (https://copi.owasp.org) is an online game engine where you can play Cornucopia and Elevation of Privilege. You can play all the editions of Cornucopia (website and mobile) as well as the Elevation of Privileges game.

please read README.md

OWASP Cornucopia - ThreatSutra

ThreatSutra is an AI-assisted security requirement generator that takes threat models from OWASP Threat Dragon models and Cornucopia card games and creates evil user stories and security verification tests which it can upload as GitHub issues. Please see ThreatSutra if you would like to contribute to the work.

여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗