OWASP Testability Patterns for Web Applications
OWASP Testability Patterns for Web Applications - An OWASP incubator project
About OWASP Testability Patterns for Web Applications
The OWASP Testability Patterns project intends to create a community to re-design the classical secure development life-cycle around the concept of Testability Patterns, providing new tools for Web and AI/ML developers, managers, and security teams. In summary, the project aims to:
Testability Patterns (TPs) are problematic code instructions that affect the capability of security testing tools. Due to TPs, security testing tools may miss vulnerabilities, or conversely, report a false alarm. This project intends to create a catalog of testability patterns.
This repository includes the catalogs of testability patterns. Currently, the project focuses on testability patterns affecting static analysis security testing tools (SAST) and it supports the following programming languages:
The repository is available at: https://github.com/testable-eu/sast-testability-patterns.
TP-Framework relies on testability patterns to reduce false positive/negative rate in SAST analysis over supported programming languages. TP-Framework enables operations such as:
These features can enable for example the following types of user experiences:
Future works include the possibility to enable patterns’ transformations directly from the framework in ordet to improve the testability of the SAST scanned application.
The repository is available at: https://github.com/testable-eu/sast-tp-framework
You can join our nascent community and help the project in different ways:
Contribution guidelines are here.
The application of standard business practices to building software applications is advancing rapidly to meet the evolving needs of web-based application software powered by artificial intelligence (AI). The EU-funded TESTABLE project proposes a software development lifecycle (SDLC) that combines two metrics to quantify the security and privacy risks of a program: the code testability and vulnerable behaviour indicators. TESTABLE will empower software/AI developers, managers, testers, and auditors to reduce the risk by building better security and privacy testing techniques for web applications and removing or mitigating the impact of the patterns causing the high-risk levels. It will develop algorithms, techniques, and tools to analyse, test, and study web applications.
Luca Compagna will talk about the project at the next OWASP AppSec Dublin
When: Thursday February 16, 2023 10:30am - 11:30am GMT
Where: Liffey Meeting Room 2
To see the complete list of publications, please visit https://testable.eu/publications/.
Project Resources
Project Leaders
Project Information
Incubator Project
Classification
Other
Language
JavaScript
License
Apache License 2.0
Contributors
8
GitHub Stars
37
Downloads
0
Corporate Supporters
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
Quick Links
Legal & Governance
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.