{"action":"created","issue":{"url":"https://api.github.com/repos/OWASP/ASVS/issues/154","repository_url":"https://api.github.com/repos/OWASP/ASVS","labels_url":"https://api.github.com/repos/OWASP/ASVS/issues/154/labels{/name}","comments_url":"https://api.github.com/repos/OWASP/ASVS/issues/154/comments","events_url":"https://api.github.com/repos/OWASP/ASVS/issues/154/events","html_url":"https://github.com/OWASP/ASVS/issues/154","id":227222591,"node_id":"MDU6SXNzdWUyMjcyMjI1OTE=","number":154,"title":"General wording - requesting prove of the negative","user":{"login":"Sergicles","id":4461395,"node_id":"MDQ6VXNlcjQ0NjEzOTU=","avatar_url":"https://avatars2.githubusercontent.com/u/4461395?v=4","gravatar_id":"","url":"https://api.github.com/users/Sergicles","html_url":"https://github.com/Sergicles","followers_url":"https://api.github.com/users/Sergicles/followers","following_url":"https://api.github.com/users/Sergicles/following{/other_user}","gists_url":"https://api.github.com/users/Sergicles/gists{/gist_id}","starred_url":"https://api.github.com/users/Sergicles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sergicles/subscriptions","organizations_url":"https://api.github.com/users/Sergicles/orgs","repos_url":"https://api.github.com/users/Sergicles/repos","events_url":"https://api.github.com/users/Sergicles/events{/privacy}","received_events_url":"https://api.github.com/users/Sergicles/received_events","type":"User","site_admin":false},"labels":[{"id":143254078,"node_id":"MDU6TGFiZWwxNDMyNTQwNzg=","url":"https://api.github.com/repos/OWASP/ASVS/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"closed","locked":false,"assignee":{"login":"jmanico","id":531465,"node_id":"MDQ6VXNlcjUzMTQ2NQ==","avatar_url":"https://avatars2.githubusercontent.com/u/531465?v=4","gravatar_id":"","url":"https://api.github.com/users/jmanico","html_url":"https://github.com/jmanico","followers_url":"https://api.github.com/users/jmanico/followers","following_url":"https://api.github.com/users/jmanico/following{/other_user}","gists_url":"https://api.github.com/users/jmanico/gists{/gist_id}","starred_url":"https://api.github.com/users/jmanico/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmanico/subscriptions","organizations_url":"https://api.github.com/users/jmanico/orgs","repos_url":"https://api.github.com/users/jmanico/repos","events_url":"https://api.github.com/users/jmanico/events{/privacy}","received_events_url":"https://api.github.com/users/jmanico/received_events","type":"User","site_admin":false},"assignees":[{"login":"jmanico","id":531465,"node_id":"MDQ6VXNlcjUzMTQ2NQ==","avatar_url":"https://avatars2.githubusercontent.com/u/531465?v=4","gravatar_id":"","url":"https://api.github.com/users/jmanico","html_url":"https://github.com/jmanico","followers_url":"https://api.github.com/users/jmanico/followers","following_url":"https://api.github.com/users/jmanico/following{/other_user}","gists_url":"https://api.github.com/users/jmanico/gists{/gist_id}","starred_url":"https://api.github.com/users/jmanico/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmanico/subscriptions","organizations_url":"https://api.github.com/users/jmanico/orgs","repos_url":"https://api.github.com/users/jmanico/repos","events_url":"https://api.github.com/users/jmanico/events{/privacy}","received_events_url":"https://api.github.com/users/jmanico/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/OWASP/ASVS/milestones/5","html_url":"https://github.com/OWASP/ASVS/milestone/5","labels_url":"https://api.github.com/repos/OWASP/ASVS/milestones/5/labels","id":1369881,"node_id":"MDk6TWlsZXN0b25lMTM2OTg4MQ==","number":5,"title":"4.0","description":"The next version of ASVS, aligned with OWASP Top 10 2017 and Testing Guide 4.0. Release at AppSec USA 2018.","creator":{"login":"vanderaj","id":5029993,"node_id":"MDQ6VXNlcjUwMjk5OTM=","avatar_url":"https://avatars3.githubusercontent.com/u/5029993?v=4","gravatar_id":"","url":"https://api.github.com/users/vanderaj","html_url":"https://github.com/vanderaj","followers_url":"https://api.github.com/users/vanderaj/followers","following_url":"https://api.github.com/users/vanderaj/following{/other_user}","gists_url":"https://api.github.com/users/vanderaj/gists{/gist_id}","starred_url":"https://api.github.com/users/vanderaj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vanderaj/subscriptions","organizations_url":"https://api.github.com/users/vanderaj/orgs","repos_url":"https://api.github.com/users/vanderaj/repos","events_url":"https://api.github.com/users/vanderaj/events{/privacy}","received_events_url":"https://api.github.com/users/vanderaj/received_events","type":"User","site_admin":false},"open_issues":19,"closed_issues":162,"state":"open","created_at":"2015-10-22T08:52:53Z","updated_at":"2019-01-02T09:13:42Z","due_on":"2018-10-17T07:00:00Z","closed_at":null},"comments":4,"created_at":"2017-05-09T01:38:21Z","updated_at":"2019-01-02T09:16:32Z","closed_at":"2019-01-02T09:13:41Z","author_association":"NONE","body":"Most control are written in a way, where they are asking the security reviewer to prove the negative.\r\n\r\nFor example:    \r\n_Verify that the application is not susceptible to LDAP Injection, or that security controls prevent LDAP Injection._\r\n\r\nIt cannot be verified that the application is not vulnerable to something. It can only be stated that the application has been tested for... Not that it has no vulnerabilities. \r\n\r\nSuggested change to something similar to:\r\nVerify that the application has been tested for LDAP Injection vulnerabilities, or that specific security controls to prevent LDAP Injection have been implemented.\r\n\r\nThis is a common issue across all controls.\r\n"},"comment":{"url":"https://api.github.com/repos/OWASP/ASVS/issues/comments/450815651","html_url":"https://github.com/OWASP/ASVS/issues/154#issuecomment-450815651","issue_url":"https://api.github.com/repos/OWASP/ASVS/issues/154","id":450815651,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MDgxNTY1MQ==","user":{"login":"jmanico","id":531465,"node_id":"MDQ6VXNlcjUzMTQ2NQ==","avatar_url":"https://avatars2.githubusercontent.com/u/531465?v=4","gravatar_id":"","url":"https://api.github.com/users/jmanico","html_url":"https://github.com/jmanico","followers_url":"https://api.github.com/users/jmanico/followers","following_url":"https://api.github.com/users/jmanico/following{/other_user}","gists_url":"https://api.github.com/users/jmanico/gists{/gist_id}","starred_url":"https://api.github.com/users/jmanico/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmanico/subscriptions","organizations_url":"https://api.github.com/users/jmanico/orgs","repos_url":"https://api.github.com/users/jmanico/repos","events_url":"https://api.github.com/users/jmanico/events{/privacy}","received_events_url":"https://api.github.com/users/jmanico/received_events","type":"User","site_admin":false},"created_at":"2019-01-02T09:16:32Z","updated_at":"2019-01-02T09:16:32Z","author_association":"MEMBER","body":"more not removal"}}
{"actor":{"display_login":"jmanico"}}