Practical articles on payment security, PCI DSS, OWASP ASVS and backend engineering for engineers who build payment systems.
Series · 8 parts
An 8-part series on PCI DSS 4.0.1, OWASP ASVS 5.0 and the OWASP Top 10:2025, written for backend engineers and tech leads who build payment systems.
PCI DSS 4.0.1 changes for developers: the 2024-2026 timeline, which of the 12 requirements engineering owns, targeted risk analysis and the customized approach.
10 min read
How a payment service provider scopes PCI DSS: CDE and connected-to systems, segmentation, tokenization limits and SAQ D service provider validation.
11 min read
OWASP ASVS 5.0 explained for engineers: its 17 chapters, how Levels 1 to 3 were rebalanced, what changed from 4.0.3, and how a team adopts the standard.
10 min read
ASVS vs OWASP Top 10: what changed in the Top 10:2025, why it is an awareness list rather than a standard, and how ASVS 5.0 gives you testable requirements.
9 min read
Build ASVS authentication for a payments admin API: Argon2id parameters, TOTP replay guards, refresh token reuse detection, CSRF and PCI DSS 4.0.1 conflicts.
10 min read
What PCI DSS 6.4.3 and 11.6.1 require, who they apply to after the SAQ A change, and how to implement them with CSP, SRI, an inventory and a weekly check.
9 min read
Can OWASP ASVS 5.0 be the secure coding standard for PCI DSS Requirement 6? A mapping table, the gaps ASVS leaves, and the evidence assessors ask for.
10 min read
How OWASP Cheat Sheets, WSTG, SAMM and MASVS fit around ASVS, and what the PCI Secure Software Standard v2.0 means for a payments engineering team.
10 min read