The Chair called the July 2026 OWASP Global Board Meeting to order at 12:02 PM EDT and conducted a roll call; all seven directors were present, and the Chair welcomed guests.
A quorum was present.
As the Board consists of individuals from many competing organizations, OWASP and its Board shall abide by all applicable anti-trust and competition laws. To avoid any perceived or actual conflict of interest, or anti-trust concerns under US federal, state, or regulations, only the published agenda shall be discussed or voted upon, or amended as below. If there are any conflicts of interest, Board members are expected to disclose the conflict of interest and must recuse themselves from discussion and voting.
The Chair read the conflict of interest and antitrust statement. No conflicts of interest were declared.
No conflicts of interest were declared.
Changes to the agenda - unless otherwise prohibited by anti-trust or competition laws - including adding, altering, or tabling of motions is permitted by following Roberts Rules of Order (RONR 12th Ed) 41:63, which requires an affirmative two-thirds vote.
The Executive Director requested the addition of a discussion item concerning an ambiguity discovered in the bylaws regarding director term limits, so that the Board could advise him before he instructs the Foundation's lawyers. Under Robert's Rules of Order, a change to the published agenda requires a two-thirds affirmative vote.
Vote (roll call):
Change to the agenda passed 7–0.
Projects Committee. Bjorn reported that there is no status update and the committee is currently dormant.
Chapters Committee. Sam Stepanyan is one volunteer short of restarting the committee and will issue a further call on Slack immediately after the meeting, with the aim of restarting in August.
A quick introduction to Lori Meagher, who is our new Associate Executive Director.
Sam Stepanyan presented a pull request updating the Chapter Policy to align it with the Leaders and Members policy in force since 2024. The changes: (a) require that OWASP chapter leaders be current OWASP members in accordance with the membership policy, replacing "participants" with "OWASP members" in the leadership eligibility language; (b) remove outdated technical instructions tied to the Meetup Pro platform (which is being decommissioned) and replace them with a requirement that all official chapter events be publicly advertised on the chapter's page on owasp.org using Foundation-approved systems; and (c) correct a typographical error. Sam noted this is the minimum procedural change, consistent with prior board decisions, and that further changes will follow via the full policy review process.
Motion: "Resolved, that the OWASP Board of Directors approves the update to the Chapter Policy to require that OWASP Chapter Leaders must be OWASP Members."
Sponsor: Sam Stepanyan Second: Marisa Fagan
Vote (roll call):
Motion passed 7–0.
Motion: Resolved, that the OWASP Board of Directors approves the update to the Chapter Policy to require that OWASP Chapter Leaders must be OWASP Members.
Sponsor: Sam Stepanyan · Second: Marisa Fagan
Ricardo Griffith reported on the overarching policy review process policy: the final questions agreed in Vienna were submitted to Abhi and the Policy Review Team; he has followed up twice and will follow up again after this meeting. He noted this should not hold up work on other policies.
The Executive Director reported that, while preparing the election materials, he identified a significant number of discrepancies between the bylaws and actual practice (for example, proxy votes and the nomination process). He proposed the Board work through these findings, with resolution before the end of the year.
On the AI policy, Ashwini Siddhi asked for a firm date, noting the AI and social media policies have been in draft for six months. The Executive Director and Ashwini Siddhi agreed to meet this month to merge their two drafts, with a draft AI policy ready for community review by the August board meeting. The Executive Director highlighted the need for the policy to cover the Foundation's internal use of AI, particularly the handling of personal data (noting a current issue with a Jira AI bot that cannot be disabled).
Missie Lindsey thanked the directors for introductions made in Vienna, which have already produced follow-up meetings, and reported very positive supporter feedback from the conference (one supporter met over 100 clients against an expectation of 40). She then updated the Board on the Advisory Council concept (Option 1, previously approved by the Board):
The Board expressed strong support for the direction and thanked Missie and Stacey for their work.
The open chapter-creation ticket backlog has been reduced to 38 tickets, down from approximately 77–78, thanks largely to Harold Blankenship's efforts following the pause caused by the move away from Meetup Pro and the wait for chapter functionality on the new website. Some processes remain more manual than desired, and progress often depends on requesters responding; student chapter requests are expected to be slow over the Northern Hemisphere summer break. Sam Stepanyan asked Harold to monitor the leaders and chapters Slack channels to prioritize chapters that already have venues and sponsors arranged and are waiting only on Foundation approval. The Executive Director thanked Harold, who is also currently processing expenses, and noted the intention to seek approval in executive session for a combined, more senior role capable of automating these processes.
Marisa Fagan reported that she and Ashwini Siddhi have started a working group, meeting Monday, to develop activities for students and to overhaul the student chapter policy, processes, and expectations of student leaders. The Executive Director has additionally asked Missie Lindsey to approach corporate supporters (e.g., Secure Code Warrior, SecureFlag) about offering CTF platforms globally or regionally for student chapters, potentially alongside OWASP's own Juice Shop.
The penetration re-test of the new website is scheduled for this Friday; nearly all tested functionality is now working, including working groups. A snapshot of the current site will be taken Thursday night and restored the following week, so any community edits made on Friday will be reverted; the Executive Director will notify the community of this today. Community feedback is being triaged — good ideas will be implemented post-launch and outstanding bugs fixed before go-live. Leo Reading was recognized for his exceptional community feedback and will be invited to re-test his own findings.
At the Chair's suggestion, and given the website delay, the Executive Director agreed as an interim measure to add the current working groups to the committees page of the existing website, renaming the menu "Committees and Working Groups," so the community can see what working groups exist and how to join them. Ricardo Griffith asked that the website also be discussed in executive session.
Ricardo Griffith introduced a proposal for the Board to consider establishing an OWASP scholarship (a university scholarship, as distinct from event sponsorship), noting it speaks directly to the Foundation's education mission and is intended as a longer-term initiative rather than for this year.
The Executive Director summarized the legal advice received: because the Foundation's original IRS Form 1023 cannot be located (dating to circa 2004, though audits back to 2007 evidence a stable mission), the Certificate of Incorporation would likely need to be restated to explicitly permit grants and scholarships. The lawyers identified approximately ten documents requiring creation or amendment; at typical rates the total cost is estimated at $25,000–$30,000, though the scope could potentially be narrowed to the essential IRS, incorporation, and bylaw changes with the remainder handled through operational documents.
All directors expressed support for pursuing the concept. Ashwini Siddhi (echoed by Marisa Fagan) recommended timing the financial commitment to follow the new strategic partnership revenue. Kelly asked whether a sponsor could fund students to attend the EU and US events in the interim; this question will be added to the matters raised with the lawyers. Harold Blankenship confirmed his support having clarified the proposal is for a university scholarship. The Chair noted the initiative would also strengthen the corporate supporter value proposition.
Outcome: The Executive Director will respond to the lawyers, request a quote for the required work, ask whether the original Form 1023 can be obtained from the IRS, include the interim sponsorship question, and consider bundling this work with the broader bylaw corrections. The Board will take the matter up again once the full legal picture and costs are known.
The Executive Director explained that two potential candidates in the upcoming election were previously appointed by the board of the day to fill vacancies, and that the current bylaws — which completely replaced the prior bylaws — are ambiguous as to whether an appointed (partial) term counts toward the two-term limit. His initial reading treated "term" in sections 4.3 and 4.6 as the same, meaning an appointed partial term counts as a first term; however, the sections can also be read independently, and Delaware courts generally construe eligibility requirements maximally. On the maximal reading, a director could serve up to two years of an appointed term plus two elected terms — up to six years.
He presented three options: (1) retain the current bylaws and clarify by documentation only — the most legally defensible position, allowing up to six years' service; (2) curtail eligibility so that an appointed portion exceeding 50% of a term counts as a first term; or (3) adopt the stricter interpretation that a director may serve only two terms (four years) in any ten-year period. He asked the Board for direction — with at least two-thirds agreement on a position — so he can instruct the lawyers, noting a formal motion to amend the Directors policy, operational documents, or bylaws will be brought to the August public board meeting regardless of the direction chosen.
In discussion, Ricardo Griffith (noting he has no intention of running again) and the Chair both favored restoring explicit clarity to the governing documents rather than relying on interpretation, so that future boards need not reconstruct this discussion. Marisa Fagan asked about the process for selecting replacement directors; the Executive Director explained that by convention — undocumented — the runner-up in the previous election has always been appointed, and Marisa indicated her focus would be on reflecting the community's wishes. The Board agreed to continue the discussion in executive session to settle on an option (likely between options 2 and 3), both of which would require legal review.
Motion: to amend the Directors policy, operational documents, or bylaws will be brought to the August public board meeting regardless of the direction chosen. In discussion, Ricardo Griffith (noting he has no intention of running again) and the Chair both favored restoring explicit clarity to the governing documents rather than relying on interpretation, so that future boards need not reconstruct this discussion. Marisa Fagan asked about the process for selecting replacement directors; the Executive Director explained that by convention — undocumented — the runner-up in the previous election has always been appointed, and Marisa indicated her focus would be on reflecting the community's wishes. The Board agreed to continue the discussion in executive session to settle on an option (likely between options 2 and 3), both of which would require legal review.
Discussion on combining the Community Support Representative and the IT Support role into a single role.
The Board adjourned at 1:25 PM EDT to a private Executive Session to discuss staffing matters.
"It is moved, and seconded to adjourn. Those in favor, say "aye""
Sponsor: Steve Springett Second: Kelly Santalucia
The next general Board meeting is on August 25, 2026, at 12 pm US Eastern Time.
Sponsor: Steve Springett · Second: Kelly Santalucia
The next general Board meeting is next general Board meeting is on August 25, 2026, at 12 pm US Eastern Time..
Slack