From b3eb4a67a6e5125942537fd321d1d8998b7455ae Mon Sep 17 00:00:00 2001 From: wshallwshall Date: Sat, 1 Aug 2026 05:11:57 -0500 Subject: [PATCH] docs: the ASVS chapter roll-up says 13 but lists 14 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit §A.3's roll-up reads "In scope: 14 chapters active today (V1–V8, V11–V16)" — it said 13. V1–V8 is 8 and V11–V16 is 6. The table directly above it is the authority and agrees with 14: exactly 14 rows carry an in-scope "Yes" (V1–V8, V11–V16), V17 is the sole "No", and V9 and V10 carry their own qualified verdicts. This is the same off-by-one that was already in the line before #111 — it read "12 chapters active (V1, V2, V4–V8, V11–V16)", which is 13. #111 correctly brought V3 into scope but carried the arithmetic error forward rather than recomputing it, so the count moved 12→13 when the list moved 13→14. Found because the website mirrors this file as `docs/secure-development-standards.md` and publishes it as `assets/MessageFoundry-Secure-Development-Standards.pdf`. That copy was corrected to 14 in website PR #105, so the two have been disagreeing since #111 merged. This makes them agree, with the engine as the correct one. The "17 chapters" statements at :243 and :248 are right and untouched — that is the total in ASVS 5.0, not the in-scope count. Co-Authored-By: Claude Opus 5 --- docs/Secure_Development_Standards.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Secure_Development_Standards.md b/docs/Secure_Development_Standards.md index fe20c28..c1f916e 100644 --- a/docs/Secure_Development_Standards.md +++ b/docs/Secure_Development_Standards.md @@ -391,7 +391,7 @@ MessageFoundry (MEFOR) is an open-source **HL7 v2.x integration engine** — a c | V16 | Security Logging and Error Handling | Yes | Tamper-resistant audit log; fail-closed errors; no PHI/secrets in logs | | V17 | WebRTC | **No** | Not applicable — no WebRTC; documented exclusion | -*In scope: 13 chapters active today (V1–V8, V11–V16). V10 (OAuth/OIDC) is now **partly active** — outbound OAuth 2.0 client-credentials / SMART on FHIR are built (ADR 0024); inbound OAuth/OIDC remains N/A. V9 (JWT) is in scope when JWT is introduced — currently N/A. Documented exclusion: V17.* +*In scope: 14 chapters active today (V1–V8, V11–V16). V10 (OAuth/OIDC) is now **partly active** — outbound OAuth 2.0 client-credentials / SMART on FHIR are built (ADR 0024); inbound OAuth/OIDC remains N/A. V9 (JWT) is in scope when JWT is introduced — currently N/A. Documented exclusion: V17.* ### A.4 Interface authentication mechanisms