AP-26 review catalogue · version 1.0
Our review standard
Our review standard is public. Everyone should be able to follow how a grade comes about.
Why AmicusProof?
“Amicus curiae” is Latin for “friend of the court”: a neutral party that supports a court without being a party itself. It has no stake in the outcome, only in the matter.
That's exactly how we see our role. We didn't write your code and we don't sell you a tool. “Proof” stands for evidence – and for your app being secured afterwards.
Six review principles
- 01
Independent
We only review, we don't build. So we have no reason to overlook our own mistakes.
- 02
On your side
Findings belong to you, not the public. You show the seal only if you want to.
- 03
Traceable
Every grade follows fixed, public rules. You can recalculate every deduction yourself.
- 04
Documented
Every review ends in a report with location and evidence. That helps you, your customers and authorities.
- 05
Data-minimal
We only process what the review needs. Code is deleted afterwards, no AI training.
- 06
Plain words
We explain findings so you don't need a computer science degree. And every finding comes with a fix.
AP-26 review catalogue
| Area | What we check | Typical findings in AI code | Weight |
|---|---|---|---|
| AAccess & permissions | Sign-in, roles, database access rules (RLS), protected pages and functions. | Tables without RLS, admin pages protected only in the frontend, roles stored on the profile. | 25 % |
| BSecrets & keys | API keys, passwords and tokens in code, configuration and delivered files. | Secret keys in the frontend bundle, public .env file, keys in git history. | 15 % |
| CInputs & attacks | Handling user input: validation, injection, XSS, rate limits. | Validation only in the browser, unfiltered HTML, forms without limits. | 20 % |
| DDependencies & supply chain | Included packages, known vulnerabilities (CVEs), origin and freshness. | Outdated packages with known holes, unused dependencies, hallucinated package names. | 15 % |
| EConfiguration & operations | HTTPS, security headers, cookies, error messages, publicly reachable files. | Missing CSP and HSTS, stack traces in errors, open .git folder. | 10 % |
| FPrivacy & German law | GDPR, imprint, consent, data flows to third countries. | Google Fonts and US trackers without consent, missing imprint, no deletion periods. | 15 % |
Grading logic
Each area gets a grade from 1.0 to 5.0. The overall grade is the weighted average – like German school grades: 1.0 is the best.
| Grade | Rating | Condition |
|---|---|---|
| 1.0 – 1.5 | excellent | No critical or high findings, at most a few low ones. |
| 1.6 – 2.5 | good | No critical findings, few medium or single low-risk high ones. |
| 2.6 – 3.5 | satisfactory | No critical findings, several high or many medium ones. |
| 3.6 – 4.5 | sufficient | Significant shortcomings or one critical finding (see knock-out rule). |
| 4.6 – 5.0 | failing | Several critical findings; operation is not recommended as is. |
Knock-out rule
A critical finding in area A (access & permissions) or B (secrets & keys) caps the overall grade at 4.0 – no matter how good the rest is. An open database can't be offset by good headers.
Severity levels
- critical
Strangers can immediately read or change data or cause costs, without special skills.
Example: the customer table is readable without signing in.
- high
An attack is possible with some effort and would have serious consequences.
Example: admin functions check the role only in the browser.
- medium
A protective layer is missing; usually not exploitable alone, but dangerous combined with other gaps.
Example: no Content Security Policy.
- low
Good practice isn't followed; the risk is small.
Example: no Permissions-Policy.
Foundations
AP-26 isn't an end in itself. It bundles recognised standards and turns them into checkable items for AI-built software.
- OWASP Top 10 – The ten most common risks for web applications.
- OWASP ASVS – The Application Security Verification Standard with detailed requirements.
- OWASP Top 10 for LLM Applications – Risks specific to applications using language models.
- BSI TR-03183 – German BSI technical guideline on cyber resilience, incl. SBOM and vulnerability management.
- EU Cyber Resilience Act, Annex I – Essential security requirements for products with digital elements.
- GDPR – The EU General Data Protection Regulation.
Transparency note
AmicusProof Verified is AmicusProof's own review standard. It is not an official certification.
AP-26, version 1.0
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-10-01 | First published version with six areas, weighting and knock-out rule. |
| 0.9 | 2026-08-15 | Draft, public comment with pilot customers. |