docs: the ASVS chapter roll-up says 13 but lists 14

[wshallwshall]

What

§A.3's chapter roll-up says 13 and then lists 14:

*In scope: 13 chapters active today (V1–V8, V11–V16).

V1–V8 is 8, V11–V16 is 6.

The table above it is the authority, and it agrees with 14

Counted straight from the applicability table in the same section:

Rows	17
In scope (Yes)	14 — V1–V8, V11–V16
Excluded (No)	1 — V17
Qualified	V9 (in scope when introduced), V10 (partly active)

Where it came from

The same off-by-one predates #111. The line previously read "12 chapters active (V1, V2, V4–V8,
V11–V16)" — which is 13. #111 correctly brought V3 into scope, but carried the arithmetic error
forward instead of recomputing, so the count went 12→13 while the list went 13→14. The error survived
the fix that touched the very same line.

How it surfaced

The website mirrors this file as docs/secure-development-standards.md and publishes it as
assets/MessageFoundry-Secure-Development-Standards.pdf (linked from the homepage and twice from
security.html). That copy was corrected to 14 in website PR #105, so the two mirrors have
disagreed since #111 merged. This makes them agree, with the engine as the correct one.

Not touched

The "17 chapters" statements at :243 and :248 are correct — that's the total in ASVS 5.0, not
the in-scope count.

One character. No other content, no scoping change, no count published anywhere new.

🤖 Generated with Claude Code