What problem does it solve? Teams preparing for security reviews or certifications lack a structured way to verify their application against the OWASP ASVS standard, often relying on guesswork instead of evidence-backed control-by-control assessment. ## Core Features & Use Cases - ASVS Level Selection: Supports L1, L2, and L3 verification levels with guidance on which chapters apply to your application type. - Automated and Manual Verification: Runs grep-based checks for authentication, session, validation, TLS, and configuration controls, then performs manual review for requirements needing judgment. - Compliance Matrix and Remediation Roadmap: Produces a Pass/Fail/N-A/Cannot-Verify matrix with evidence, summary statistics, and a prioritized remediation plan written to .marvin/security/compliance-asvs.md. - Use Case: Before a release, ask for an ASVS L2 audit of your web app and receive a control-by-control gap analysis with file:line evidence and effort estimates for each failure. ## Quick Start Ask the assistant to run an ASVS L2 compliance audit on this project and report the gaps with remediation steps.
