2026
Peer-Reviewed Research
Security Vulnerabilities in AI-Generated Code: A Large-Scale Analysis of Public GitHub Repositories
Material CWE-mapped weaknesses were identified in the dataset.
- Security & Supply Chain
- AI-Assisted Development
Evidence note
OWASP Application Security Verification Standard 5.0.0
Practitioner Reference2025OWASP Foundation
What does it cover?
A structured application-security verification standard containing concrete requirements for assessing technical security controls.
Key points
- 1ASVS is designed around application-security verification requirements rather than high-level awareness categories.
- 2It provides a substantially stronger verification reference than treating the OWASP Top 10 alone as a security assessment.
- 3Requirement identifiers should be referenced with their version because they can change between releases.
Why it matters. Lornets interpretation.
Security assurance should be based on evidence against relevant technical requirements rather than simply asking whether an application appears to address a list of common vulnerabilities.
This is the Lornets reading of the source, not a finding of the source itself.
What it does not establish
- 1Lornets should not claim ASVS certification unless an applicable independent mechanism actually exists and has been completed.
- 2Not every ASVS requirement applies equally to every system.
- 3Security verification remains contextual and may require specialist testing beyond the scope of a standard Production Readiness Assessment.
Source
- Organisation
- OWASP Foundation
- Evidence type
- Practitioner Reference
- Published
- 2025
- Version
- 5.0.0
- Status
- Current
Relevant Lornets framework areas
Framework domains
- Security & Access Control
Related evidence
Last verified 2026-08-11
2022
Government Guidance
NIST Secure Software Development Framework v1.1
SSDF organises secure-development practices into a structured set of outcomes rather than prescribing one development methodology.
Current, revision underway
National Institute of Standards and Technology, SP 800-218, SSDF v1.1
- Security & Supply Chain
- Software Quality & Maintainability
2026
Government Guidance
Software Security Code of Practice: Assurance Principles and Claims
The guidance uses assurance claims rather than treating high-level principles as self-evident.
UK National Cyber Security Centre
- Security & Supply Chain
- Enterprise Assurance