{"source":"https://contributable.vercel.app","licence":"CC BY 4.0","methodology":"https://contributable.vercel.app/methodology","v":2,"owner":"OWASP","name":"wstg","updatedAt":"2026-10-11T05:38:41.047Z","coveredSince":"2025-10-04T15:12:20.511Z","facts":{"owner":"OWASP","name":"wstg","description":"The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.","stars":9995,"forks":1703,"archived":false,"isFork":false,"license":"CC-BY-SA-4.0","defaultBranch":"master","pushedAt":"2026-10-10T16:03:23Z","createdAt":"2017-05-14T23:20:40Z","topics":["best-practices","guide","owasp","bugbounty","penetration-testing","pentesting","application-security","security","hacktoberfest","appsec","hacking"],"languages":{"Python":37535,"CSS":36111,"JavaScript":17080,"HTML":16186,"Shell":473,"Ruby":109},"frameworks":[],"commits90d":125,"releases365d":6,"lastReleaseAt":"2023-09-28T15:19:36Z","gettingStarted":{"contributing":true,"codeOfConduct":true,"issueTemplates":true,"devcontainer":false,"cla":"none","channels":[{"kind":"slack","url":"https://owasp.org/slack/invite"},{"kind":"mailing-list","url":"https://groups.google.com/a/owasp.org/forum/#!forum/testing-guide-project"}],"policy":null}},"metrics":{"computedAt":"2026-10-11T05:38:41.047Z","outsidePulls":{"cohort":{"n":21,"merged":17,"closedUnmerged":4,"open":0,"mergeRate":0.8095238095238095,"openShare":0,"evidence":{"merged":[1509,1508,1506,1505,1492,1490,1485,1484,1481,1477,1448,1442,1441,1439,1431,1429,1427],"closedUnmerged":[1482,1454,1453,1440],"open":[]}},"firstTimers":{"n":10,"merged":8,"closedUnmerged":2,"open":0,"mergeRate":0.8,"openShare":0,"evidence":{"merged":[1506,1490,1481,1448,1441,1431,1429,1427],"closedUnmerged":[1453,1440],"open":[]}},"year":{"n":102,"merged":79,"closedUnmerged":22,"open":1,"mergeRate":0.7821782178217822,"openShare":0.00980392156862745,"evidence":{"merged":[1509,1508,1506,1505,1492,1490,1485,1484,1481,1477,1448,1442,1441,1439,1431,1429,1427,1426,1423,1416],"closedUnmerged":[1482,1454,1453,1440,1418,1417,1414,1412,1408,1403,1382,1376,1359,1342,1325,1312,1298,1295,1293,1273],"open":[1267]}}},"pullFirstResponse":{"n":21,"answered":20,"waiting":1,"medianHours":2.0383333333333336,"p75Hours":6.616388888888889,"within48h":0.7619047619047619,"within7d":0.8095238095238095,"curve":[{"hours":0.029444444444444443,"waiting":0.9523809523809523},{"hours":0.09666666666666666,"waiting":0.9047619047619047},{"hours":0.1713888888888889,"waiting":0.8571428571428571},{"hours":0.7786111111111111,"waiting":0.8095238095238094},{"hours":0.7855555555555556,"waiting":0.7619047619047618},{"hours":0.7994444444444444,"waiting":0.7142857142857142},{"hours":0.9091666666666667,"waiting":0.6666666666666666},{"hours":0.925,"waiting":0.6190476190476191},{"hours":1.3988888888888888,"waiting":0.5714285714285715},{"hours":2.0169444444444444,"waiting":0.5238095238095238},{"hours":2.0383333333333336,"waiting":0.4761904761904762},{"hours":2.5372222222222223,"waiting":0.4285714285714286},{"hours":2.730277777777778,"waiting":0.380952380952381},{"hours":3.515833333333333,"waiting":0.33333333333333337},{"hours":5.4911111111111115,"waiting":0.28571428571428575},{"hours":6.616388888888889,"waiting":0.23809523809523814},{"hours":67.04583333333333,"waiting":0.19047619047619052},{"hours":278.13,"waiting":0.1428571428571429},{"hours":335.50194444444446,"waiting":0.09523809523809527},{"hours":357.17833333333334,"waiting":0.04761904761904764}],"evidence":{"answered":[1509,1508,1506,1505,1492,1490,1485,1484,1482,1481,1477,1453,1448,1442,1441,1440,1439,1431,1429,1427],"waiting":[1454]}},"timeToMerge":{"n":21,"merged":17,"medianHours":4.142777777777778,"evidence":[1509,1508,1506,1505,1492,1490,1485,1484,1481,1477,1448,1442,1441,1439,1431,1429,1427]},"issueFirstResponse":{"n":10,"answered":8,"waiting":2,"medianHours":0.7127777777777777,"p75Hours":2.7280555555555557,"within48h":0.7999999999999999,"within7d":0.7999999999999999,"curve":[{"hours":0.05138888888888889,"waiting":0.9},{"hours":0.31472222222222224,"waiting":0.7999999999999999},{"hours":0.3433333333333333,"waiting":0.7},{"hours":0.6408333333333334,"waiting":0.6},{"hours":0.7127777777777777,"waiting":0.5},{"hours":2.2294444444444443,"waiting":0.4},{"hours":2.706111111111111,"waiting":0.30000000000000004},{"hours":2.7280555555555557,"waiting":0.20000000000000004}],"evidence":{"answered":[1519,1491,1489,1483,1472,1447,1444,1433],"waiting":[1445,1428]}},"starter":{"counts":{"available":0,"claimed":0,"in-progress":2,"stale":0},"helpWantedAvailable":0,"issues":[{"n":637,"title":"Should SSRF/LFI/RFI be relocated for v5?","state":"in-progress","label":"help-wanted","createdAt":"2020-11-25T22:37:09Z","updatedAt":"2026-02-16T13:23:50Z"},{"n":535,"title":"Hackerone and Bugcrowd Links","state":"stale","label":"help-wanted","createdAt":"2020-08-04T10:16:34Z","updatedAt":"2026-02-17T15:30:28Z"},{"n":14,"title":"Add Testing Integrating / Third Party Services (OTG-CONFIG-011)","state":"in-progress","label":"beginner","createdAt":"2018-01-29T15:15:37Z","updatedAt":"2026-09-12T12:10:49Z"},{"n":5,"title":"Adapt guide to be inclusive of API testing","state":"in-progress","label":"beginner","createdAt":"2017-06-15T11:12:08Z","updatedAt":"2026-08-10T22:23:13Z"}]},"responseWindow":{"hours":[0,0,0,0,0,0,0,0,0,0,0,0,1,0,5,0,0,1,0,1,1,0,5,3,0,0,0,0,0,0,0,0,0,0,0,0,5,6,0,2,3,1,0,0,2,0,2,1,0,0,1,0,0,0,0,0,0,0,1,1,1,6,1,0,9,1,0,1,0,1,0,2,2,4,0,1,0,0,0,0,0,3,0,0,1,0,5,1,0,0,1,2,5,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,6,1,0,1,0,0,1,0,0,0,1,0,3,0,0,0,0,0,0,0,0,0,0,1,0,1,1,0,0,0,0,0,3,0,0,0,0,2,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,1,0,0,1],"people":4,"replies":116},"activeMaintainers":6},"series":[{"week":"2025-10-12","opened":0,"merged":0,"answered7d":0,"activity":2},{"week":"2025-10-19","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-10-26","opened":1,"merged":1,"answered7d":1,"activity":4},{"week":"2025-11-02","opened":0,"merged":0,"answered7d":0,"activity":1},{"week":"2025-11-09","opened":2,"merged":1,"answered7d":1,"activity":7},{"week":"2025-11-16","opened":1,"merged":0,"answered7d":0,"activity":3},{"week":"2025-11-23","opened":2,"merged":2,"answered7d":2,"activity":6},{"week":"2025-11-30","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-12-07","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-12-14","opened":0,"merged":0,"answered7d":0,"activity":2},{"week":"2025-12-21","opened":3,"merged":2,"answered7d":2,"activity":6},{"week":"2025-12-28","opened":3,"merged":2,"answered7d":3,"activity":12},{"week":"2026-01-04","opened":3,"merged":3,"answered7d":1,"activity":16},{"week":"2026-01-11","opened":1,"merged":1,"answered7d":1,"activity":2},{"week":"2026-01-18","opened":3,"merged":3,"answered7d":3,"activity":8},{"week":"2026-01-25","opened":4,"merged":2,"answered7d":3,"activity":32},{"week":"2026-02-01","opened":7,"merged":6,"answered7d":7,"activity":45},{"week":"2026-02-08","opened":3,"merged":2,"answered7d":2,"activity":12},{"week":"2026-02-15","opened":8,"merged":6,"answered7d":6,"activity":75},{"week":"2026-02-22","opened":2,"merged":2,"answered7d":1,"activity":13},{"week":"2026-03-01","opened":3,"merged":3,"answered7d":3,"activity":21},{"week":"2026-03-08","opened":7,"merged":6,"answered7d":7,"activity":27},{"week":"2026-03-15","opened":3,"merged":3,"answered7d":3,"activity":21},{"week":"2026-03-22","opened":5,"merged":4,"answered7d":5,"activity":16},{"week":"2026-03-29","opened":5,"merged":4,"answered7d":5,"activity":39},{"week":"2026-04-05","opened":1,"merged":1,"answered7d":1,"activity":29},{"week":"2026-04-12","opened":2,"merged":1,"answered7d":1,"activity":13},{"week":"2026-04-19","opened":4,"merged":3,"answered7d":4,"activity":19},{"week":"2026-04-26","opened":1,"merged":0,"answered7d":0,"activity":1},{"week":"2026-05-03","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-05-10","opened":1,"merged":1,"answered7d":1,"activity":3},{"week":"2026-05-17","opened":1,"merged":0,"answered7d":1,"activity":4},{"week":"2026-05-24","opened":3,"merged":1,"answered7d":3,"activity":8},{"week":"2026-05-31","opened":1,"merged":1,"answered7d":1,"activity":7},{"week":"2026-06-07","opened":1,"merged":1,"answered7d":1,"activity":5},{"week":"2026-06-14","opened":2,"merged":2,"answered7d":1,"activity":7},{"week":"2026-06-21","opened":1,"merged":1,"answered7d":1,"activity":7},{"week":"2026-06-28","opened":2,"merged":1,"answered7d":2,"activity":17},{"week":"2026-07-05","opened":2,"merged":2,"answered7d":2,"activity":4},{"week":"2026-07-12","opened":0,"merged":0,"answered7d":0,"activity":3},{"week":"2026-07-19","opened":0,"merged":0,"answered7d":0,"activity":2},{"week":"2026-07-26","opened":1,"merged":1,"answered7d":1,"activity":5},{"week":"2026-08-02","opened":2,"merged":0,"answered7d":0,"activity":13},{"week":"2026-08-09","opened":0,"merged":0,"answered7d":0,"activity":17},{"week":"2026-08-16","opened":1,"merged":1,"answered7d":1,"activity":16},{"week":"2026-08-23","opened":4,"merged":3,"answered7d":4,"activity":21},{"week":"2026-08-30","opened":6,"merged":6,"answered7d":5,"activity":39},{"week":"2026-09-06","opened":0,"merged":0,"answered7d":0,"activity":19},{"week":"2026-09-13","opened":2,"merged":2,"answered7d":2,"activity":27},{"week":"2026-09-20","opened":2,"merged":2,"answered7d":2,"activity":12},{"week":"2026-09-27","opened":4,"merged":2,"answered7d":2,"activity":7},{"week":"2026-10-04","opened":8,"merged":4,"answered7d":7,"activity":18}],"trend":{"flag":"slowed-down","recentMedianHours":1.6108333333333333,"previousMedianHours":0.9091666666666667,"recentN":16,"previousN":11,"openedThisWeek":8,"openedLastWeek":4},"programs":[{"program":"gsoc","slug":"owasp-foundation","name":"OWASP Foundation","years":[2024,2025,2026]}]}