docs: the ASVS chapter roll-up says 13 but lists 14 - #116
Merged
Conversation
§A.3's roll-up reads "In scope: 14 chapters active today (V1–V8, V11–V16)" — it said 13. V1–V8 is 8 and V11–V16 is 6. The table directly above it is the authority and agrees with 14: exactly 14 rows carry an in-scope "Yes" (V1–V8, V11–V16), V17 is the sole "No", and V9 and V10 carry their own qualified verdicts. This is the same off-by-one that was already in the line before #111 — it read "12 chapters active (V1, V2, V4–V8, V11–V16)", which is 13. #111 correctly brought V3 into scope but carried the arithmetic error forward rather than recomputing it, so the count moved 12→13 when the list moved 13→14. Found because the website mirrors this file as `docs/secure-development-standards.md` and publishes it as `assets/MessageFoundry-Secure-Development-Standards.pdf`. That copy was corrected to 14 in website PR #105, so the two have been disagreeing since #111 merged. This makes them agree, with the engine as the correct one. The "17 chapters" statements at :243 and :248 are right and untouched — that is the total in ASVS 5.0, not the in-scope count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
§A.3's chapter roll-up says 13 and then lists 14:
V1–V8is 8,V11–V16is 6.The table above it is the authority, and it agrees with 14
Counted straight from the applicability table in the same section:
Yes)No)Where it came from
The same off-by-one predates #111. The line previously read "12 chapters active (V1, V2, V4–V8,
V11–V16)" — which is 13. #111 correctly brought V3 into scope, but carried the arithmetic error
forward instead of recomputing, so the count went 12→13 while the list went 13→14. The error survived
the fix that touched the very same line.
How it surfaced
The website mirrors this file as
docs/secure-development-standards.mdand publishes it asassets/MessageFoundry-Secure-Development-Standards.pdf(linked from the homepage and twice fromsecurity.html). That copy was corrected to 14 in website PR #105, so the two mirrors havedisagreed since #111 merged. This makes them agree, with the engine as the correct one.
Not touched
The "17 chapters" statements at
:243and:248are correct — that's the total in ASVS 5.0, notthe in-scope count.
One character. No other content, no scoping change, no count published anywhere new.
🤖 Generated with Claude Code