For full functionality of this site it is necessary to enable JavaScript. Here are the  .
This website uses cookies to analyze our traffic and only share that information with our analytics partners.
Accept
x
Rules of Procedure
# Community Review Process
1. 
2. 
Adopted by the Board on June 23, 2020
## Overview
The primary purpose of the OWASP Community Review (CR) is to systematically improve policies with regards to services, events, chapters, projects, committees, and programs that drive the visibility and evolution of safety and security of the world’s software. To achieve this purpose, the Community Review has been designed as an open member facing collaborative review for OWASP Members to provide their input in an easy and inclusive process.
## Key Attributes
* Members have a voice in Foundation Policy
* Policy commenting shall be done in a fashion that protects dissenting opinions
* A Policy Review Team will be created each calendar year for policy review
* All comments to policies will be answered
* Policies will be approved by the Policy Review Team and Board of Directors
## Review/Approval Process
1. The Community Review process is initiated when a new policy is needed, or an existing policy needs to be revised.
2. Once the policy has been developed or revised and ready for review, it will be uploaded to < and the title will be labeled with “(Draft WIP)”.
3. When the Review Process will begin, an email notification will be sent to all OWASP Members.
4. Only those who are OWASP Members are eligible to review and submit comments on the policy.
* The review process is open for 21 days. No further comments will be accepted after the review period has closed.
* All comments should be specific edits and must be submitted through the appropriate mailing list topic (linked via the banner on the “Draft WIP” policy or policies.
1. Once the review period is closed all comments will be sent to the Policy Review Team (PRT):
* OWASP Review Team has 30 days to review all comments.
* Comments can either be:
* Accepted: Means the PRT agreed exactly with the comment and change proposed by the commenter, which results in changes made to the policy.
* Revised: Means the PRT agrees with the comment (at least in part) and implements a change that is not exactly what the commenter proposed, still resulting in changes made to the policy.
* Rejected: Means the PRT does not agree to make the change or cannot come to a consensus to make changes necessary to address the comment. A rationale should be provided to explain why the comment is being rejected.
* Comments along with the comment resolution document will be posted to the website.
1. Once the comments have been reviewed and changes made to the policy based on comments that have been accepted or revised, the Policy Review Team votes to recommend to the OWASP Board the approval of the final document.
2. Policy Review Team sends the policy and comment resolution document along with their recommendation for approval to the OWASP Board.
3. The OWASP Board votes to approve the new or revised policy. If the board disapproves the policy, it is sent back along with the rationale for the disapproval to the Policy Review Team of the policy for review and revision to policy. Then sent back to the board for approval.
4. Once approved, the policy is posted to the OWASP website having removed the “Draft WIP” label.
5. Notice via email will be provided to Members and Leaders of the new policy.
## Policy Review Team
1. Comprised of seven members who are seated on January 1st of each calendar year.
2. Membership is limited to Members and Membership must be maintained for continued service.
3. Membership of the Team includes:
* One Project Leader from a Flagship Project, as invited in descending website traffic order.
* One Chapter Leader from an active Chapter, as invited in descending website traffic order.
* One Staff Member as assigned by the Executive Director.
* Up to two not re-elected Board Members from the previous election.
* As many Board Member nominees who were not elected from the previous election, as invited in descending voting order
to reach a total of seven members.
1. Where members are invited, invitations are valid for seven days, will be made via email on or before December 1st, and will be revoked once expired.
2. Should any Policy Review Team members be unable to complete their term, a like selected member will be invited.
3. Project and Chapter Leader members cannot serve consecutive year terms.
---
**The OWASP® Foundation** works to improve the security of software through its community-led open source software projects,
hundreds of chapters worldwide, tens of thousands of members, and by hosting local and global conferences.
### Rules of Procedure
* Community Review Process
### Upcoming OWASP Global Events
## Corporate Supporters
OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, and LASCON are trademarks of the OWASP Foundation, Inc. Unless otherwise specified, all content on the site is Creative Commons Attribution-ShareAlike v4.0 and provided without warranty of service or accuracy. For more information, please refer to our . OWASP does not endorse or recommend commercial products or services, allowing our community to remain vendor neutral with the collective wisdom of the best minds in software security worldwide. Copyright 2025, OWASP Foundation, Inc.
# Conference & Event Attendee
Adopted by the Board on 22-Sept-2020
## Conference & Event Attendees
The OWASP Foundation and its supporters host events around the world in a variety of formats. The following policy applies to all OWASP branded and “supported by OWASP” events. Other policies may apply and can be found on the event’s website.
### Registration and Badges
At events where a badge is provided, your badge must be always visible. Spouses, friends, peers, etc. are not granted access to any conference areas or events without a badge. If you wish for anyone to accompany you to any of the conference events including meals, receptions, breaks or sessions, you must register them and pay the appropriate fees. Lost, misplaced, stolen, or forgotten badges will incur a replacement fee equal to the current, on-site rate of your pass type. If your badge was complimentary, the fee will be the current, on-site rate.
### Discount Codes
Some OWASP Events have attendee and participant fees. From time-to-time, the Foundation may elect, at its sole discretion, to offer discounts for certain attendees. Discount Codes are not transferable and using one indicates that you qualify for the offer and its restrictions. Any attempt to defraud the Foundation and its partners could result in the cancellation of your registration with no refund.
### Cancellation Policy
Since ticket sales are final, the Foundation does not offer refunds. The sole exception to this policy is when an event or session is cancelled at the Foundation’s convenience. Regional events can use their discretion to make exceptions to this policy provided a sufficient budget. We strongly suggest training registrants purchase travel insurance in the event their session is cancelled.
### Privacy Policy Statement
Your attendance at OWASP Foundation Events and the information you provide to participate in such are governed by the . Additionally, please note in most cases, your event registration information is also provided to sponsors to whom you allow your badge to be scanned or business card collected. Attendees are under no obligation to have their credentials scanned or collected, but certain event sponsors may limit your eligibility for special event giveaways or offers. If you do not wish to share your registration information with event sponsors, please do not allow your credentials to be scanned or collected.
During event registration and related communications, OWASP may collect the following information:
* name and job title
* contact information including email address and phone number
* demographic information such as postcode, preferences and interests
### Photography
OWASP events are open to the public, and OWASP does not restrict attendees (including OWASP staff, volunteers, sponsors, and media) from taking photos or videos at our events. By attending our events, you acknowledge that you are in a public space and that attendees (including OWASP staff, volunteers, sponsors, and media) may capture your image in photos and videos. Nevertheless, OWASP encourages event attendees to exercise common sense and good judgment and respect the wishes of other attendees who do not wish to be photographed at the Events.
OWASP reserves the right to use images taken at conference and events with your photograph or likeness in future marketing materials.
### Conference and Event Anti-Harassment Policy
Attendees, staff, sponsors, and exhibitors at Foundation Conferences and Events shall together provide a harassment-free experience for everyone, regardless of gender, sexual orientation, disability, physical appearance, body size, race, age, or religion. We do not tolerate harassment of conference participants in any form. Additionally, participating in our events means you shall also adhere to the .
Conference participants who violate these rules may be sanctioned or expelled from the conference without a refund at the discretion of the conference organizers. Harassment includes offensive verbal comments related to gender, sexual orientation, disability, physical appearance, body size, race, or religion, and actions such as deliberate intimidation, stalking, following, harassing photography or recording, sustained disruption of talks or other events, inappropriate physical contact, and unwelcome sexual attention.
* Participants who are asked to stop any harassing behavior are expected to comply immediately.
* Exhibitors in the expo hall, sponsor or vendor booths, or similar activities are also subject to the anti-harassment policy. In particular, exhibitors should not use sexualized images, activities, or other material. Booth staff (including volunteers) should not use sexualized clothing/uniforms/costumes, or otherwise create a sexualized environment.
* If a participant engages in harassing behavior, the conference organizers may take appropriate action, including warning the offender or expulsion from the conference with no refund.
* If you are being harassed, notice that someone else is being harassed, or have any other concerns, please contact a member of conference staff immediately.
* Conference staff will be available to help participants contact hotel/venue security or local law enforcement, provide escorts, or otherwise assist those experiencing harassment to feel safe for the duration of the conference. We value your attendance.
* Conference & Event Attendee
# Conflict Resolution
This document aims to outline the process and expectations to be followed when raising a concern or conflict within OWASP. This document strives to create a usable system where concerns can be voiced, responded to, and resolved. In addition, this process is intended to ensure the system of discussion does not overwhelm individuals who are not interested or necessary in the conflict discussion.
## Assume Positive Intent First
1. Information and intent can be lost within electronic communication.
2. Before raising any issue it is strongly recommended to consult with the specific individual(s) related to the issue and openly clarify the issue.
3. After clarifying the situation if a conflict is still present then the situation should be addressed.
## Raising a Conflict
To clarify OWASP policy and receive other opinions on the situation the issue should be directed to the 
## Use of Leaders List
1. It is appropriate, if necessary, to send a single email to the leaders list to advise them of the situation and ask for involvement/comments within the governance thread.
2. However, the leaders list is specifically NOT to be used for discussion of the conflict. The leaders list contains many people, many of whom will not be related to the specific incident. Conflict related threads on the leaders list will be refocused to the Governance list.
* Conflict Resolution