Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Writing Security Requirements: Choosing a Level with OWASP ASVS 5.0, Acceptance Criteria and Security Champions
A security requirement means choosing an ASVS level in writing and verifying every selected item with a test or evidence, not filling in 345 rows. For Bookstore: an ASVS 5.0 Level 2 target plus one Level 3 item taken on purpose, a requirements file, security acceptance criteria and an abuse story, the Definition of Done, an xUnit test that keeps the file and the tests in step, the security champion and a NIST SSDF mapping.
OWASP Beyond the Top 10: API Security, LLM Top 10, ASVS and the Cheat Sheet Series
We step outside the Top 10: the API Security Top 10 (2023) and the split between BOLA, BOPLA and BFLA, preventing property-level data exposure with a response DTO, the Top 10 for LLM Applications (2025), ASVS 5.0 and the Cheat Sheet Series. We also talk about how the series continues with new Top 10 editions and which security series come next.
Putting the OWASP Top 10 Together: Secure Defaults for ASP.NET Core and Angular
We put the ten categories together in a single Program.cs: fallback policy, cookie flags, ProblemDetails, rate limiting that returns 429, security headers and rejecting unknown JSON fields. We verify everything with curl, do SAST with the .NET analyzers, write security regression tests with WebApplicationFactory, and talk about DAST and moving to ASVS 5.0.