# description
A machine readable catalog of security checks for software built with AI coding tools. Designed for an LLM or coding agent to fetch, filter by the traits of the app in front of it, run, and report on.

# properties.catalog_version.description
Semantic version of the catalog format and contents.

# properties.updated.description
ISO 8601 date the catalog last changed. Derived from the guide's changelog, never typed.

# properties.license.description
How the catalog may be used, quoted from the terms page rather than summarised, so this and the terms cannot grant different rights.

# properties.license_url.description
The full terms. The only place that can change the grant.

# properties.license_spdx.description
SPDX identifier, or null when none has been declared. Null is deliberate rather than missing: no identifier has been granted by the terms page, and machines act on identifiers, so guessing one from a resemblance would be worse than leaving it empty.

# properties.source_url.description
The human readable guide this catalog is generated from.

# properties.versioned_url.description
The same bytes at an address that names catalog_version, so an agent can fetch exactly the version it cited. Only the current version is served; the changelog is the record of what changed.

# properties.tag_vocabulary.description
The closed set of applies_when values, each with what it means. An agent matches these against the app it is looking at.

# properties.build_sequence.description
The order to build in, in five phases. Follow this while building rather than reading it afterwards. Each stage carries the proof that it is finished, so an agent can say which stage the work is actually at instead of guessing.

# properties.master_prompt.description
The standing instruction to give a coding tool before the work starts. The per-check ai_prompt fields are for auditing one thing; this is for the whole job.

# properties.power_ladder.description
What an AI may be allowed to do, by tier, and what each tier requires before it is allowed. Use it to decide what tools to hand an agent, which is the decision that cannot be undone by a later instruction.

# properties.agent_rules.description
Rules for building an agent, as opposed to building with one.

# properties.limitations.description
What this catalog does not give you, stated as data because the thing reading it is a machine. The most important one is no_code: every fix is a requirement, not an implementation, so a check is not handled because its fix was read.

# properties.see_also.description
The rest of the guide, named so it does not have to be discovered. The AI risk list, the laws that can apply, the stack a product needs and inversion thinking are prose rather than data an agent acts on, so they live behind these URLs rather than being duplicated here.

# $defs.check.properties.id.description
Stable identifier. Never changes, never reused. Use this, not the number, to refer to a check.

# $defs.check.properties.number.description
Position in the human guide. Can shift when checks are inserted, so do not key on it.

# $defs.check.properties.also_known_as.description
The industry names for what this check teaches, for joining the guide to OWASP, a scanner or a ticket queue. The guide's own prose is written in plain words on purpose, so these appear beside a check and never inside it. Empty where a check does not map onto a named class, which is most of the process ones. An empty array is a deliberate blank, not missing data.

# $defs.check.properties.group.description
The section of the guide this check sits in.

# $defs.check.properties.severity.description
What happens if this is ignored. critical loses data, money or control. low is hygiene.

# $defs.check.properties.hard_stop.description
When true an agent must surface this before doing anything else and must not continue until the human acknowledges it.

# $defs.check.properties.hard_stop_reason.description
Required when hard_stop is true. Why the agent has to stop.

# $defs.check.properties.applies_when.description
Run this check when the app has any of these traits. 'always' means every app.

# $defs.check.properties.what_it_means.description
Plain explanation of the idea, for a reader who has not met it.

# $defs.check.properties.how_it_goes_wrong.description
Concrete ways this fails in a real product.

# $defs.check.properties.how_to_test.description
Steps a person or an agent can carry out to find out whether this is a problem here.

# $defs.check.properties.how_to_fix.description
What to change. Ordered, smallest useful change first.

# $defs.check.properties.proof_of_success.description
The observable state that means this check passes. An agent should not report pass without it.

# $defs.check.properties.ai_prompt.description
Ready to paste. Instructs the tool to read the real files, report findings first, rank them, admit when it found nothing, and wait before changing code.

# $defs.check.properties.standards.description
External framework entries this check maps to.

# $defs.check.properties.sources.description
Primary sources supporting this check. Empty means no source in the guide's list supports it specifically, which is stated rather than papered over.

# $defs.standard.properties.raw.description
As printed on the page, for example OWASP API1:2023.

# $defs.standard.properties.parsed.description
False when the tag could not be read. Reported rather than dropped, because a tag nobody can parse is a fact about the data.

# $defs.standard.properties.frameworkId.description
Stable slug for the framework, for grouping.

# $defs.standard.properties.edition.description
The edition year. Editions renumber and entries move between them.

# $defs.standard.properties.id.description
Entry plus edition, unique within a framework.

# $defs.standard.properties.title.description
The entry's own title where this site holds one, null where it does not.

# $defs.standard.properties.url.description
Resolved from the guide's source list, never typed twice.

# $defs.standard.properties.source.description
Which source the URL came from, so the checked date can be looked up.

# $defs.source.properties.checked.description
The date somebody last opened this link and confirmed it says what is claimed.