From d0fdf892c655906c15171b4f78332597ab8b884b Mon Sep 17 00:00:00 2001 From: GangGreenTemperTatum <104169244+GangGreenTemperTatum@users.noreply.github.com> Date: Tue, 24 Oct 2023 20:21:40 -0700 Subject: [PATCH 1/2] chore: update readme with lab status --- README.md | 8 ++++---- info.md | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 80df16d1..38dd61c5 100644 --- a/README.md +++ b/README.md @@ -3,20 +3,20 @@ OWASP Foundation Web Repository # OWASP Top 10 for Large Language Model Applications -[![OWASP Incubator](https://img.shields.io/badge/owasp-incubator-blue.svg)](https://owasp.org/projects/) +[![OWASP Lab Status project](https://img.shields.io/badge/owasp-labstatus-blue.svg)](https://owasp.org/projects/) [![License: CC BY-SA 4.0](https://img.shields.io/badge/License-CC%20BY--SA%204.0-lightgrey.svg)](https://creativecommons.org/licenses/by-sa/4.0/) Welcome to the official repository for the OWASP Top 10 for Large Language Model Applications! ## Overview -The OWASP Top 10 for Large Language Model Applications is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to Large Language Model (LLM) applications. +The OWASP Top 10 for Large Language Model Applications is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to Large Language Model (LLM) applications. -Our mission is to make application security visible, so that people and organizations can make informed decisions about application security risks related to LLMs. +Our mission is to make application security visible, so that people and organizations can make informed decisions about application security risks related to LLMs. ## Key Focus -The primary aim of this project is to provide a comprehensible and adoptable guide to navigate the potential security risks in LLM applications. Our Top 10 list serves as a starting point for developers and security professionals who are new to this domain, and as a reference for those who are more experienced. +The primary aim of this project is to provide a comprehensible and adoptable guide to navigate the potential security risks in LLM applications. Our Top 10 list serves as a starting point for developers and security professionals who are new to this domain, and as a reference for those who are more experienced. The list includes, among others, vulnerability types like "Prompt Injections", "Data Leakage", "Inadequate Sandboxing", "Data Poisoning", and many more. diff --git a/info.md b/info.md index b42c0981..1c0aef75 100644 --- a/info.md +++ b/info.md @@ -1,5 +1,5 @@ ### Top 10 for Large Language Model Applications Information -* [Incubator Project](https://owasp.org/projects/) +* [Lab Status Project](https://owasp.org/projects/) * [Version 1.1.0](assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf) * [Version 1.0.1](assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_0_1.pdf) (archived) * [Version 1.0.0](assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_0.pdf) (archived) From 93c95895ef3524fbea4634b3c6b3f12c8b7fdda5 Mon Sep 17 00:00:00 2001 From: GangGreenTemperTatum <104169244+GangGreenTemperTatum@users.noreply.github.com> Date: Tue, 24 Oct 2023 20:52:21 -0700 Subject: [PATCH 2/2] docs: update readme with additional context --- README.md | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 38dd61c5..ac6067e3 100644 --- a/README.md +++ b/README.md @@ -5,30 +5,34 @@ OWASP Foundation Web Repository [![OWASP Lab Status project](https://img.shields.io/badge/owasp-labstatus-blue.svg)](https://owasp.org/projects/) [![License: CC BY-SA 4.0](https://img.shields.io/badge/License-CC%20BY--SA%204.0-lightgrey.svg)](https://creativecommons.org/licenses/by-sa/4.0/) +[![llmtop10.com](https://img.shields.io/badge/officialsite-llmtop10.com-032CFA.svg)](https://llmtop10.com) Welcome to the official repository for the OWASP Top 10 for Large Language Model Applications! -## Overview +## Overview and Audience 🗣️ -The OWASP Top 10 for Large Language Model Applications is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to Large Language Model (LLM) applications. +The OWASP Top 10 for Large Language Model Applications is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to Large Language Model (LLM) applications. There are other ongoing frameworks both inside and outside of OWASP that are not to be confused with this project and is currently scoped towards only LLM Application Security. -Our mission is to make application security visible, so that people and organizations can make informed decisions about application security risks related to LLMs. +Our primary audience is developers, data scientists, and security experts tasked with designing and building applications and plugins leveraging LLM technologies. We aim to provide practical, actionable, and concise security guidance to help these professionals navigate the complex and evolving terrain of LLM application security. -## Key Focus +## Key Focus 📖 The primary aim of this project is to provide a comprehensible and adoptable guide to navigate the potential security risks in LLM applications. Our Top 10 list serves as a starting point for developers and security professionals who are new to this domain, and as a reference for those who are more experienced. -The list includes, among others, vulnerability types like "Prompt Injections", "Data Leakage", "Inadequate Sandboxing", "Data Poisoning", and many more. +## Mission Statement 🚀 -## Contribution +Our mission is to make application security visible, so that people and organizations can make informed decisions about application security risks related to LLMs. While our list shares DNA with vulnerability types found in other OWASP Top 10 lists, we do not simply reiterate these vulnerabilities. Instead, we delve into these vulnerabilities’ unique implications when encountered in applications utilizing LLMs. + +Our goal is to bridge the divide between general application security principles and the specific challenges posed by LLMs. The group’s goals include exploring how conventional vulnerabilities may pose different risks or be exploited in novel ways within LLMs and how developers must adapt traditional remediation strategies for applications utilizing LLMs. + +## Contribution 👋 The first version of this list was contributed by Steve Wilson of Contrast Security. We encourage the community to contribute and help improve the project. If you have any suggestions, feedback or want to help improve the list, feel free to open an issue or send a pull request. We have a working group channel on the [OWASP Slack](https://owasp.org/slack/invite), so please sign up and then join us on the #project-top10-llm channel. -Please hop over to [our wiki page](https://github.com/OWASP/www-project-top-10-for-large-language-model-applications/wiki) to collaborate on the project. +Please hop over to [our wiki page](https://github.com/OWASP/www-project-top-10-for-large-language-model-applications/wiki) to collaborate on the project and stay up to date with the latest meetings and current roadmap. ## License -This project is licensed under the terms of the [Creative Commons Attribution-ShareAlike 4.0 International License](https://creativecommons.org/licenses/by-sa/4.0/). - +This project is licensed under the terms of the [Creative Commons Attribution-ShareAlike 4.0 International License](https://creativecommons.org/licenses/by-sa/4.0/). \ No newline at end of file