August 2026 Minutes

Board will conduct a SWOT analysis ahead of the January 2027 Leuven Board Summit. Andrew will start a Board thread to collect inputs. A facilitated session will be arranged for Belgium.

All audit documentation submitted. Draft audit letter expected September–October, ahead of the Nov 15 deadline.

AR meeting held with Charity CFO; new process established. Approx. $500K outstanding targeted for collection. Write‑offs discussed; one item (~$30K) exceeds ED authorization threshold. Board requested formal approval process for write‑offs exceeding staff limits.

Andrew and Lori completed induction and minor staff reorganization. Conflict‑of‑interest registry gaps identified; directors will be asked to resubmit missing disclosures.

ED to meet with Ricardo to finalize role definition and proceed with candidate outreach.

Venue secured; last week of January 2027 reserved. Goal to align with FOSDEM dates if possible.

EU directors obtained €1M coverage at favorable rates.

One candidate at least has an incomplete application. Board agreed that it is okay to proactively request missing information before eligibility review window.

Debt collection matter resolved; second invoice under review for voiding.

IRS residency certificate requested 4 months ago; still not received. Sponsors for Portugal Days require it; may need to reapply.

New OWASP website ready for deployment. Policies and flagship project pages updated.

Remaining blockers:

• Email reputation / SendGrid configuration
• MFA / passkey support (Board concern: do not launch without MFA)
• Meetup‑replacement features (RSVP limits, hidden links, stats)
• ED will assess feasibility of implementing MFA before launch.

Key Metrics (as of July 2026)

• Cash on hand: $2.2M (5.3 months operating reserve)
• Net assets: $3.3M
• Net income YTD: $790K
• Revenue: $3.7M (30% over budget)
• Expenses: 6% over budget
• Conference revenue: 81% of total; sponsorships 51% of conference revenue
• AR Write‑offs
• CFO will send detailed list to Board.
• Automated AR reporting to begin monthly on the 18th.
• Board confirmed AR reporting will continue monthly.

Avi Douglen led the discussion of the current status of the Policy Reviews. The Process Review Policy requires complete rewrite, not revision. Board confirmed Ricardo and Harold will draft new version in a shared Google Doc. Policy Review Team will review once Board submits draft. Additional policies (AI policy, CSR, anti‑slavery, sanctions/force majeure) require updates. Andrew noted need for clearer project management via Monday.com, and will help set up the Policy Review Team in Monday.com to assist with review and tracking of policies.

Background The public Board meeting in October is currently scheduled for the 27th of October 2026. The public Board meeting should be moved to be in person at AppSec San Francisco 2026, on Wednesday November 4, 2026, at a time and meeting room to be determined by meeting room availability. Sam asked for the exact time and location to be determined before the motion was voted upon. This change is reflected in the revised motion below, which was what was voted upon. This will allow the Board to meet in person with the community and to allow the Board to attend the conference. Passing this motion will also move the Board prep call one week later.

Revised Motion: "Resolved, that the OWASP Foundation Board of Directors moves the October 2026 public Board meeting to be held in person at AppSec San Francisco 2026 on November 4, 2026, at 5.30 pm PST in room Waterfront E."

Sponsor: Ricardo Griffith Second: Sam Stepanyan

• Steve Springett YES
• Ricardo Griffith YES
• Harold Blankenship YES
• Sam Stepanyan YES
• Ashwini Siddhi YES
• Marisa Fagan YES

Kelly Santalucia was absent.

Vote: 6-0. Motion PASSED unanimously.

Highlights

• 353 QR scans, 115 new members, including 5 lifetime members.
• Strong collaboration with multiple villages and community groups.
• High engagement with project showcase and workshops.
• Renewed partnerships with AI Village, Maker Village, No Starch Press, B‑Sides Philly.
• Aikido provided two free Black Hat passes.

Board praised the exceptional success and outreach impact.

Legal advice indicates OWASP may not be able to accept contributions from individuals in sanctioned countries (e.g., Iran). ED will seek specialist OFAC counsel.

Board discussed need for:

• Click‑through sanctions declarations for project creation
• CLA integration
• Automated SDN/OFAC screening
• Updates to project policy and force majeure/sanctions policy
• The Board will discuss the legal advice and determine if any action is needed.

Backlog reduced from 90+ days to <30 days. 55 tickets awaiting customer response. System now reopens tickets automatically when users reply.

Chapter Committee: One additional member needed; Sam pursuing candidates.

Project Committee: Committee has not met requirements for active status (no elections, few meetings).

Education Committee: Also inactive; ED will notify and request new officers.

Board agreed ED will notify committee of inactivity; 30‑day window to respond.

If no action, committee will be dissolved per policy.

Financial Outcome Budgeted profit: $180K Actual profit: ~$320K (nearly double)

Attendance: 948 attendees — largest OWASP conference to date. Survey Results: 177 responses (highest ever). 91% “very likely to return.”

Feedback:

• Mixed views on AI content volume
• Need larger project showcase room (already planned for 2027–2028)
• Venue allows multi‑floor expansion for future growth.