SteerSpec/hub
Standards as realms. Pin a standard the way you pin core, and measure your rules against every clause.
“We cover 80 % of ASVS L2.” That sentence needs a denominator. Today a SteerSpec project sees only the clauses its own rules map. A clause nobody mapped is invisible, and a typo in a clause number passes.
SteerSpec Hub publishes standards as versioned Standard Realms: every clause of the standard, with its own number and level, as Published rules. Your project depends on one the way it depends on core. Coverage, gaps and typos then become checks your CI can run.
SteerSpec itself still holds no clause list. Each realm is published under the standard’s own licence, with attribution to its authors.
// First up the pilot realm
# realm dev.steerspec.std.owasp.asvs.v5 OWASP ASVS 5.0.0 CC BY-SA 4.0 # profile requirements status L1 70 in progress L2 253 planned L3 345 planned
The realm will be generated from OWASP’s own machine-readable release, never typed by hand. Levels are cumulative, so the L2 profile includes every L1 requirement.
// Follow along
The hub is built in the open at github.com/steerspec-hub. Until it launches, SteerSpec itself lives at steerspec.dev.