OWASP · mkoppmann · Jul 27, 2026 · Jul 27, 2026
diff --git a/1. Introduction.md b/1. Introduction.md
diff --git a/2. Curriculum.md b/2. Curriculum.md
diff --git a/3. OWASP Body of Knowledge.md b/3. OWASP Body of Knowledge.md
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1,24 @@
+# Contributing to OCSD
+
+Hi :-)
+
+Welcome to the OCSD Curriculum project.
+
+The curriculum is split into multiple domains.
+Each domain has a dedicated folder and contains the following files:
+
+* The “Objectives” file contains the curriculum for the domain.
+* A file named after the domain that includes the list of topics a certified developer should know about.
+* The “References” file that:
+  * contains material/references from other OWASP projects,
+  * and content from any other open source (not copyrighted) project, if a suitable license was used.
+    MIT and Apache 2.0 may be ok, but licenses that require attribution might be problematic, like CC-BY-4.
+* The “Supplementary Reading” file contains more reading material for the exam.
+* The “Parking Lot” file contains content that has not been included in the other files yet.
+
+The topics are the high-level security constructs that a developer is expected to know.
+For example, a foundation-level developer needs to know about threat modelling, but they may not necessarily know how to threat model.
+Hence, adding content around threat modelling may not add to the body of knowledge.
+But adding sub-topics on what a developer needs to know about threat modelling will help.
+
+Please [open an issue](https://github.com/OWASP/OCSD/issues) if you have any questions.
diff --git a/...nd Threat Modelling/01.00 - Objectives.md → ...nd Threat Modelling/01.00 - Objectives.md b/...nd Threat Modelling/01.00 - Objectives.md → ...nd Threat Modelling/01.00 - Objectives.md
diff --git a/...rity Architecture and Threat Modelling.md → ...rity Architecture and Threat Modelling.md b/...rity Architecture and Threat Modelling.md → ...rity Architecture and Threat Modelling.md
diff --git a/...nd Threat Modelling/01.02 - References.md → ...nd Threat Modelling/01.02 - References.md b/...nd Threat Modelling/01.02 - References.md → ...nd Threat Modelling/01.02 - References.md
diff --git a/...01.03 - Supplementary Reading Material.md → ...01.03 - Supplementary Reading Material.md b/...01.03 - Supplementary Reading Material.md → ...01.03 - Supplementary Reading Material.md
diff --git a/...d Threat Modelling/01.04 - Parking Lot.md → ...d Threat Modelling/01.04 - Parking Lot.md b/...d Threat Modelling/01.04 - Parking Lot.md → ...d Threat Modelling/01.04 - Parking Lot.md
diff --git a/...edential Management/02.00 - Objectives.md → ...edential Management/02.00 - Objectives.md b/...edential Management/02.00 - Objectives.md → ...edential Management/02.00 - Objectives.md
diff --git a/...thentication and Credential Management.md → ...thentication and Credential Management.md b/...thentication and Credential Management.md → ...thentication and Credential Management.md
diff --git a/...edential Management/02.02 - References.md → ...edential Management/02.02 - References.md b/...edential Management/02.02 - References.md → ...edential Management/02.02 - References.md
diff --git a/...02.03 - Supplementary Reading Material.md → ...02.03 - Supplementary Reading Material.md b/...02.03 - Supplementary Reading Material.md → ...02.03 - Supplementary Reading Material.md
diff --git a/...dential Management/02.04 - Parking Lot.md → ...dential Management/02.04 - Parking Lot.md b/...dential Management/02.04 - Parking Lot.md → ...dential Management/02.04 - Parking Lot.md
diff --git a/...um/03.Authorisation/03.00 - Objectives.md → .../03 - Authorisation/03.00 - Objectives.md b/...um/03.Authorisation/03.00 - Objectives.md → .../03 - Authorisation/03.00 - Objectives.md
diff --git a/...03.Authorisation/03.01 - Authorisation.md → ... - Authorisation/03.01 - Authorisation.md b/...03.Authorisation/03.01 - Authorisation.md → ... - Authorisation/03.01 - Authorisation.md
diff --git a/...um/03.Authorisation/03.02 - References.md → .../03 - Authorisation/03.02 - References.md b/...um/03.Authorisation/03.02 - References.md → .../03 - Authorisation/03.02 - References.md
diff --git a/...3.03 - Supplementary Reading Materials.md → ...3.03 - Supplementary Reading Materials.md b/...3.03 - Supplementary Reading Materials.md → ...3.03 - Supplementary Reading Materials.md
diff --git a/...and Output Encoding/04.00 - Objectives.md → ...and Output Encoding/04.00 - Objectives.md b/...and Output Encoding/04.00 - Objectives.md → ...and Output Encoding/04.00 - Objectives.md
diff --git a/... Input Validation and Output Encoding.md → ... Input Validation and Output Encoding.md b/... Input Validation and Output Encoding.md → ... Input Validation and Output Encoding.md
diff --git a/...and Output Encoding/04.02 - References.md → ...and Output Encoding/04.02 - References.md b/...and Output Encoding/04.02 - References.md → ...and Output Encoding/04.02 - References.md
diff --git a/...4.03 - Supplementary Reading Materials.md → ...4.03 - Supplementary Reading Materials.md b/...4.03 - Supplementary Reading Materials.md → ...4.03 - Supplementary Reading Materials.md
diff --git a/...nd Output Encoding/04.04 - Parking Lot.md → ...nd Output Encoding/04.04 - Parking Lot.md b/...nd Output Encoding/04.04 - Parking Lot.md → ...nd Output Encoding/04.04 - Parking Lot.md
diff --git a/... and Key Management/05.00 - Objectives.md → ... and Key Management/05.00 - Objectives.md b/... and Key Management/05.00 - Objectives.md → ... and Key Management/05.00 - Objectives.md
diff --git a/....01 - Cryptography and Key Management.md → ....01 - Cryptography and Key Management.md b/....01 - Cryptography and Key Management.md → ....01 - Cryptography and Key Management.md
diff --git a/... and Key Management/05.02 - References.md → ... and Key Management/05.02 - References.md b/... and Key Management/05.02 - References.md → ... and Key Management/05.02 - References.md
diff --git a/...5.03 - Supplementary Reading Materials.md → ...5.03 - Supplementary Reading Materials.md b/...5.03 - Supplementary Reading Materials.md → ...5.03 - Supplementary Reading Materials.md
diff --git a/...and Key Management/05.04 - Parking Lot.md → ...and Key Management/05.04 - Parking Lot.md b/...and Key Management/05.04 - Parking Lot.md → ...and Key Management/05.04 - Parking Lot.md
diff --git a/...m/06.Error Handling/06.00 - Objectives.md → ...06 - Error Handling/06.00 - Objectives.md b/...m/06.Error Handling/06.00 - Objectives.md → ...06 - Error Handling/06.00 - Objectives.md
diff --git a/....Error Handling/06.01 - Error Handling.md → ... Error Handling/06.01 - Error Handling.md b/....Error Handling/06.01 - Error Handling.md → ... Error Handling/06.01 - Error Handling.md
diff --git a/...m/06.Error Handling/06.02 - References.md → ...06 - Error Handling/06.02 - References.md b/...m/06.Error Handling/06.02 - References.md → ...06 - Error Handling/06.02 - References.md
diff --git a/...6.03 - Supplementary Reading Materials.md → ...6.03 - Supplementary Reading Materials.md b/...6.03 - Supplementary Reading Materials.md → ...6.03 - Supplementary Reading Materials.md
diff --git a/.../06.Error Handling/06.04 - Parking Lot.md → ...6 - Error Handling/06.04 - Parking Lot.md b/.../06.Error Handling/06.04 - Parking Lot.md → ...6 - Error Handling/06.04 - Parking Lot.md
diff --git a/...m/07.Secure Logging/07.00 - Objectives.md → ...07 - Secure Logging/07.00 - Objectives.md b/...m/07.Secure Logging/07.00 - Objectives.md → ...07 - Secure Logging/07.00 - Objectives.md
diff --git a/....Secure Logging/07.01 - Secure Logging.md → ... Secure Logging/07.01 - Secure Logging.md b/....Secure Logging/07.01 - Secure Logging.md → ... Secure Logging/07.01 - Secure Logging.md
diff --git a/...m/07.Secure Logging/07.02 - References.md → ...07 - Secure Logging/07.02 - References.md b/...m/07.Secure Logging/07.02 - References.md → ...07 - Secure Logging/07.02 - References.md
diff --git a/...7.03 - Supplementary Reading Materials.md → ...7.03 - Supplementary Reading Materials.md b/...7.03 - Supplementary Reading Materials.md → ...7.03 - Supplementary Reading Materials.md
diff --git a/.../07.Secure Logging/07.04 - Parking Lot.md → ...7 - Secure Logging/07.04 - Parking Lot.md b/.../07.Secure Logging/07.04 - Parking Lot.md → ...7 - Secure Logging/07.04 - Parking Lot.md
diff --git a/...tection and Privacy/08.00 - Objectives.md → ...tection and Privacy/08.00 - Objectives.md b/...tection and Privacy/08.00 - Objectives.md → ...tection and Privacy/08.00 - Objectives.md
diff --git a/...cy/08.01 - Data Protection and Privacy.md → ...cy/08.01 - Data Protection and Privacy.md b/...cy/08.01 - Data Protection and Privacy.md → ...cy/08.01 - Data Protection and Privacy.md
diff --git a/...tection and Privacy/08.02 - References.md → ...tection and Privacy/08.02 - References.md b/...tection and Privacy/08.02 - References.md → ...tection and Privacy/08.02 - References.md
diff --git a/...8.03 - Supplementary Reading Materials.md → ...8.03 - Supplementary Reading Materials.md b/...8.03 - Supplementary Reading Materials.md → ...8.03 - Supplementary Reading Materials.md
diff --git a/...ection and Privacy/08.04 - Parking Lot.md → ...ection and Privacy/08.04 - Parking Lot.md b/...ection and Privacy/08.04 - Parking Lot.md → ...ection and Privacy/08.04 - Parking Lot.md
diff --git a/...cure Communications/09.00 - Objectives.md → ...cure Communications/09.00 - Objectives.md b/...cure Communications/09.00 - Objectives.md → ...cure Communications/09.00 - Objectives.md
diff --git a/...ications/09.01 - Secure Communications.md → ...ications/09.01 - Secure Communications.md b/...ications/09.01 - Secure Communications.md → ...ications/09.01 - Secure Communications.md
diff --git a/...cure Communications/09.02 - References.md → ...cure Communications/09.02 - References.md b/...cure Communications/09.02 - References.md → ...cure Communications/09.02 - References.md
diff --git a/...9.03 - Supplementary Reading Materials.md → ...9.03 - Supplementary Reading Materials.md b/...9.03 - Supplementary Reading Materials.md → ...9.03 - Supplementary Reading Materials.md
diff --git a/...ure Communications/09.04 - Parking Lot.md → ...ure Communications/09.04 - Parking Lot.md b/...ure Communications/09.04 - Parking Lot.md → ...ure Communications/09.04 - Parking Lot.md
diff --git a/...pen source software/10.00 - Objectives.md → ...pen source software/10.00 - Objectives.md b/...pen source software/10.00 - Objectives.md → ...pen source software/10.00 - Objectives.md
diff --git a/...10.01 - Software Supply Chain Security.md → ...10.01 - Software Supply Chain Security.md b/...10.01 - Software Supply Chain Security.md → ...10.01 - Software Supply Chain Security.md
diff --git a/...pen source software/10.02 - References.md → ...pen source software/10.02 - References.md b/...pen source software/10.02 - References.md → ...pen source software/10.02 - References.md
diff --git a/...0.03 - Supplementary Reading Materials.md → ...0.03 - Supplementary Reading Materials.md b/...0.03 - Supplementary Reading Materials.md → ...0.03 - Supplementary Reading Materials.md
diff --git a/...en source software/10.04 - Parking Lot.md → ...en source software/10.04 - Parking Lot.md b/...en source software/10.04 - Parking Lot.md → ...en source software/10.04 - Parking Lot.md
diff --git a/...ness Logic Security/11.00 - Objectives.md → ...ness Logic Security/11.00 - Objectives.md b/...ness Logic Security/11.00 - Objectives.md → ...ness Logic Security/11.00 - Objectives.md
diff --git a/...curity/11.01 - Business Logic Security.md → ...curity/11.01 - Business Logic Security.md b/...curity/11.01 - Business Logic Security.md → ...curity/11.01 - Business Logic Security.md
diff --git a/...ness Logic Security/11.02 - References.md → ...ness Logic Security/11.02 - References.md b/...ness Logic Security/11.02 - References.md → ...ness Logic Security/11.02 - References.md
diff --git a/...1.03 - Supplementary Reading Materials.md → ...1.03 - Supplementary Reading Materials.md b/...1.03 - Supplementary Reading Materials.md → ...1.03 - Supplementary Reading Materials.md
diff --git a/...ess Logic Security/11.04 - Parking Lot.md → ...ess Logic Security/11.04 - Parking Lot.md b/...ess Logic Security/11.04 - Parking Lot.md → ...ess Logic Security/11.04 - Parking Lot.md
diff --git a/...d Resource Handling/12.00 - Objectives.md → ...d Resource Handling/12.00 - Objectives.md b/...d Resource Handling/12.00 - Objectives.md → ...d Resource Handling/12.00 - Objectives.md
diff --git a/...01 - Secure File and Resource Handling.md → ...01 - Secure File and Resource Handling.md b/...01 - Secure File and Resource Handling.md → ...01 - Secure File and Resource Handling.md
diff --git a/...d Resource Handling/12.02 - References.md → ...d Resource Handling/12.02 - References.md b/...d Resource Handling/12.02 - References.md → ...d Resource Handling/12.02 - References.md
diff --git a/...2.03 - Supplementary Reading Materials.md → ...2.03 - Supplementary Reading Materials.md b/...2.03 - Supplementary Reading Materials.md → ...2.03 - Supplementary Reading Materials.md
diff --git a/... Resource Handling/12.04 - Parking Lot.md → ... Resource Handling/12.04 - Parking Lot.md b/... Resource Handling/12.04 - Parking Lot.md → ... Resource Handling/12.04 - Parking Lot.md
diff --git a/...eb Service Security/13.00 - Objectives.md → ...eb Service Security/13.00 - Objectives.md b/...eb Service Security/13.00 - Objectives.md → ...eb Service Security/13.00 - Objectives.md
diff --git a/....01 - API and Web Service Security_WIP.md → ....01 - API and Web Service Security_WIP.md b/....01 - API and Web Service Security_WIP.md → ....01 - API and Web Service Security_WIP.md
diff --git a/...eb Service Security/13.02 - References.md → ...eb Service Security/13.02 - References.md b/...eb Service Security/13.02 - References.md → ...eb Service Security/13.02 - References.md
diff --git a/...3.03 - Supplementary Reading Materials.md → ...3.03 - Supplementary Reading Materials.md b/...3.03 - Supplementary Reading Materials.md → ...3.03 - Supplementary Reading Materials.md
diff --git a/...b Service Security/13.04 - Parking Lot.md → ...b Service Security/13.04 - Parking Lot.md b/...b Service Security/13.04 - Parking Lot.md → ...b Service Security/13.04 - Parking Lot.md
diff --git a/...tion and Deployment/14.00 - Objectives.md → ...tion and Deployment/14.00 - Objectives.md b/...tion and Deployment/14.00 - Objectives.md → ...tion and Deployment/14.00 - Objectives.md
diff --git a/... - Secure Configuration and Deployment.md → ... - Secure Configuration and Deployment.md b/... - Secure Configuration and Deployment.md → ... - Secure Configuration and Deployment.md
diff --git a/...tion and Deployment/14.02 - References.md → ...tion and Deployment/14.02 - References.md b/...tion and Deployment/14.02 - References.md → ...tion and Deployment/14.02 - References.md
diff --git a/...4.03 - Supplementary Reading Materials.md → ...4.03 - Supplementary Reading Materials.md b/...4.03 - Supplementary Reading Materials.md → ...4.03 - Supplementary Reading Materials.md
diff --git a/...ion and Deployment/14.04 - Parking Lot.md → ...ion and Deployment/14.04 - Parking Lot.md b/...ion and Deployment/14.04 - Parking Lot.md → ...ion and Deployment/14.04 - Parking Lot.md
diff --git a/...urity of and for AI/15.00 - Objectives.md → ...urity of and for AI/15.00 - Objectives.md b/...urity of and for AI/15.00 - Objectives.md → ...urity of and for AI/15.00 - Objectives.md
diff --git a/... for AI/15.01 - Security of and for AI.md → ... for AI/15.01 - Security of and for AI.md b/... for AI/15.01 - Security of and for AI.md → ... for AI/15.01 - Security of and for AI.md
diff --git a/...urity of and for AI/15.02 - References.md → ...urity of and for AI/15.02 - References.md b/...urity of and for AI/15.02 - References.md → ...urity of and for AI/15.02 - References.md
diff --git a/...5.03 - Supplementary Reading Materials.md → ...5.03 - Supplementary Reading Materials.md b/...5.03 - Supplementary Reading Materials.md → ...5.03 - Supplementary Reading Materials.md
diff --git a/...rity of and for AI/15.04 - Parking Lot.md → ...rity of and for AI/15.04 - Parking Lot.md b/...rity of and for AI/15.04 - Parking Lot.md → ...rity of and for AI/15.04 - Parking Lot.md
diff --git a/... Security Awareness/16.00 - Objectives.md → ... Security Awareness/16.00 - Objectives.md b/... Security Awareness/16.00 - Objectives.md → ... Security Awareness/16.00 - Objectives.md
diff --git a/...per Environment and Security Awareness.md → ...per Environment and Security Awareness.md b/...per Environment and Security Awareness.md → ...per Environment and Security Awareness.md
diff --git a/... Security Awareness/16.02 - References.md → ... Security Awareness/16.02 - References.md b/... Security Awareness/16.02 - References.md → ... Security Awareness/16.02 - References.md
diff --git a/...6.03 - Supplementary Reading Materials.md → ...6.03 - Supplementary Reading Materials.md b/...6.03 - Supplementary Reading Materials.md → ...6.03 - Supplementary Reading Materials.md
diff --git a/...Security Awareness/16.04 - Parking Lot.md → ...Security Awareness/16.04 - Parking Lot.md b/...Security Awareness/16.04 - Parking Lot.md → ...Security Awareness/16.04 - Parking Lot.md
diff --git a/READ ME before contributing.md b/READ ME before contributing.md
diff --git a/README.md b/README.md
@@ -1,5 +1,56 @@
-# OCSD
-OWASP Certified Secure-Software Developer - the repository for the the proposed OCSD certification
+# OWASP Certified Secure Developer (OCSD)
 
-
-OWASP Project link: [https://owasp.org/www-project-certified-secure-developer/](https://owasp.org/www-project-certified-secure-developer/)
+Welcome to the OCSD curriculum repository.
+The scope of this certification is Web Application Security.
+The OCSD is a foundation-level exam.
+This is the official OWASP project link: <https://owasp.org/www-project-certified-secure-developer/>
+
+This certification program is an answer to the questions a hiring manager for a developer might ask, to validate security knowledge of the candidate.
+It is also for the developers who want to showcase their skills in developing secure code.
+
+Remember:
+
+* ***Writing secure code != testing the security of code with tools***
+* ***If developers do not put security in the code, no one else will***
+
+The questions we may want to ask are:
+
+* If I am hiring a web application developer, what are the security related skills I would look for?
+* If I were a web application developer, what security skills would I like to be validated for?
+
+[CONTRIBUTING](./CONTRIBUTING.md) explains the structure of this repository.
+
+## Curriculum Modules
+
+Here are the curriculum modules that the working group for OCSD has arrived at:
+
+1. Secure Architecture and Threat Modeling
+2. Authentication and Credential Management
+3. Authorisation
+4. Input Validation and Output Encoding
+5. Cryptography and Key Management
+6. Error Handling
+7. Secure Logging
+8. Data Protection and Privacy
+9. Secure Communications
+10. Software Supply Chain Security
+11. Business Logic Security
+12. Secure File and Resource Handling
+13. API and Web Service Security
+14. Secure Configuration and Deployment
+15. Security of and for AI
+16. Secure Developer Environment and Security Awareness
+
+## Body of Knowledge
+
+We try to include references to established OWASP projects first, but are open to other open-source materials too, if the license is suitable for our use case.
+Here is an excerpt of OWASP projects that we are referencing:
+
+* <https://owasp.org/www-project-application-security-verification-standard/>
+* <https://cheatsheetseries.owasp.org/index.html>
+* <https://devguide.owasp.org/>
+* <https://owaspsamm.org/>
+* <https://owasp.org/www-project-mobile-app-security/>
+* <https://owasp.org/www-project-top-ten/>
+* <https://owasp.org/www-project-web-security-testing-guide/>
+* <https://owasp.org/www-project-code-review-guide/>