ASVS 5.0 V13.1.1 requires you to document all communication needs of the application: every external service it relies on, and every case where an end user can supply a location the application then connects to. It is a Level 2 requirement.
This is the input to your firewall rules, your egress allowlist (V13.2.4) and your incident response. If you cannot list what the app talks to, you cannot restrict it.
Why it matters
When a library or dependency is compromised, the question is where data can go. Teams without an inventory discover that a forgotten analytics call, a webhook feature or an image fetcher gave the attacker an exit. User supplied destinations are the classic server side request forgery entry point.
How to implement it
Keep a short, versioned file next to the code. A YAML record per dependency works well:
- name: payments-api
direction: outbound
host: api.payments.example
port: 443
protocol: https
purpose: card authorization
data_sent: order id, amount, token
auth: mTLS client certificate
owner: payments-team
- name: customer-webhooks
direction: outbound
host: user supplied
protocol: https
purpose: event delivery to customer endpoints
controls: https only, resolved IP must be public, 5s timeout
Include third party SDKs that phone home, package registries used at build time, telemetry and error tracking, DNS and time servers, and every feature that fetches a URL on a user's behalf. Generate a first draft from code search and network flow logs, then review it with the team that owns each integration. Review it whenever a dependency is added.
How to test it
Compare documentation to reality. Capture outbound connections from a staging run (flow logs, a proxy log or ss -tnp) and diff the destinations against the file. Any destination missing from the document is a finding, and so is any entry that no longer appears.
Common mistakes
- Documenting only the big integrations and skipping SDKs and telemetry.
- Forgetting user controlled destinations such as webhooks, import by URL and link previews.
- Writing it once and never reviewing it.
Quick check
Do user supplied URLs belong in the document?
Yes. V13.1.1 names them explicitly, with the controls that limit where they can point.
