The Card Decks

Both current decks have six suits and there are also two Joker cards. Each suit contains 13 cards (Ace, 2-10, Jack, Queen and King). This page contains the card browser where you can browse through each of the cards in the OWASP Cornucopia decks.

API Integration

Here you will find the API documentation to more easily integrate against OWASP Cornucopia and use the cards and card codes in other systems.

Card Browser

large-language-models LLM2

large-language-models LLM3

large-language-models LLM4

large-language-models LLM5

large-language-models LLM6

large-language-models LLM7

large-language-models LLM8

large-language-models LLM9

large-language-models LLMX

large-language-models LLMJ

large-language-models LLMQ

large-language-models LLMK

large-language-models LLMA

cloud CLD2

cloud CLD3

cloud CLD4

cloud CLD5

cloud CLD6

cloud CLD7

cloud CLD8

cloud CLD9

cloud CLDX

cloud CLDJ

cloud CLDQ

cloud CLDK

cloud CLDA

frontend FRE2

frontend FRE3

frontend FRE4

frontend FRE5

frontend FRE6

frontend FRE7

frontend FRE8

frontend FRE9

frontend FREX

frontend FREJ

frontend FREQ

frontend FREK

frontend FREA

devops DVO2

devops DVO3

devops DVO4

devops DVO5

devops DVO6

devops DVO7

devops DVO8

devops DVO9

devops DVOX

devops DVOJ

devops DVOQ

devops DVOK

devops DVOA

automated-threats BOT2

automated-threats BOT3

automated-threats BOT4

automated-threats BOT5

automated-threats BOT6

automated-threats BOT7

automated-threats BOT8

automated-threats BOT9

automated-threats BOTX

automated-threats BOTJ

automated-threats BOTQ

automated-threats BOTK

automated-threats BOTA

agentic-ai AAI2

agentic-ai AAI3

agentic-ai AAI4

agentic-ai AAI5

agentic-ai AAI6

agentic-ai AAI7

agentic-ai AAI8

agentic-ai AAI9

agentic-ai AAIX

agentic-ai AAIJ

agentic-ai AAIQ

agentic-ai AAIK

agentic-ai AAIA

Companion version

The third Cornucopia deck, the “Companion Edition”, is a companion to the other two decks:

└── LARGE LANGUAGE MODELS

└── CLOUD

└── FRONTEND

└── DEVOPS

└── AUTOMATED THREATS

└── AGENTIC AI

Agentic AI
2

Tay can misinterpret user intent due to insufficient context isolation or prompt enforcement and execute actions outside the expected task scope

OWASP Cornucopia

OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams identify security requirements in Agile, conventional and formal development processes. It is language, platform and technology-agnostic, and is free to use. OWASP Cornucopia is licensed under the Creative Commons Attribution-ShareAlike 4.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar licence to this one.

© 2012-2025 OWASP Foundation. The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software.