Application Security Verification Standard 3.0 [pdf](owasp.org)

https://www.owasp.org/images/6/67/OWASPApplicationSecurityVerificationStandard3.0.pdf