The Card Decks

Both current decks have six suits and there are also two Joker cards. Each suit contains 13 cards (Ace, 2-10, Jack, Queen and King). This page contains the card browser where you can browse through each of the cards in the OWASP Cornucopia decks.

API Integration

Here you will find the API documentation to more easily integrate against OWASP Cornucopia and use the cards and card codes in other systems.

Card Browser

platform-&-code PC2

platform-&-code PC3

platform-&-code PC4

platform-&-code PC5

platform-&-code PC6

platform-&-code PC7

platform-&-code PC8

platform-&-code PC9

platform-&-code PCX

platform-&-code PCJ

platform-&-code PCQ

platform-&-code PCK

platform-&-code PCA

authentication-&-authorization AA2

authentication-&-authorization AA3

authentication-&-authorization AA4

authentication-&-authorization AA5

authentication-&-authorization AA6

authentication-&-authorization AA7

authentication-&-authorization AA8

authentication-&-authorization AA9

authentication-&-authorization AAX

authentication-&-authorization AAJ

authentication-&-authorization AAQ

authentication-&-authorization AAK

authentication-&-authorization AAA

network-&-storage NS2

network-&-storage NS3

network-&-storage NS4

network-&-storage NS5

network-&-storage NS6

network-&-storage NS7

network-&-storage NS8

network-&-storage NS9

network-&-storage NSX

network-&-storage NSJ

network-&-storage NSQ

network-&-storage NSK

network-&-storage NSA

resilience RS2

resilience RS3

resilience RS4

resilience RS5

resilience RS6

resilience RS7

resilience RS8

resilience RS9

resilience RSX

resilience RSJ

resilience RSQ

resilience RSK

resilience RSA

cryptography CRM2

cryptography CRM3

cryptography CRM4

cryptography CRM5

cryptography CRM6

cryptography CRM7

cryptography CRM8

cryptography CRM9

cryptography CRMX

cryptography CRMJ

cryptography CRMQ

cryptography CRMK

cryptography CRMA

cornucopia CM2

cornucopia CM3

cornucopia CM4

cornucopia CM5

cornucopia CM6

cornucopia CM7

cornucopia CM8

cornucopia CM9

cornucopia CMX

cornucopia CMJ

cornucopia CMQ

cornucopia CMK

cornucopia CMA

wild-card JOAM

wild-card JOBM

Mobile App version

The second Cornucopia deck, the “Mobile App Edition”, follows the same principles and game rules as the original OWASP Cornucopia, but has different suits based on the MASVS categories, in addition to the Cornucopia suit that contains threats related to mobile malware and privacy issues:

└── PLATFORM & CODE

└── AUTHENTICATION & AUTHORIZATION

└── NETWORK & STORAGE

└── RESILIENCE

└── CRYPTOGRAPHY

└── CORNUCOPIA

└── WILD CARD

Platform & Code
2

Andrew can expose sensitive data through the app's auto-generated screenshots when the app moves to the background

OWASP Cornucopia

OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams identify security requirements in Agile, conventional and formal development processes. It is language, platform and technology-agnostic, and is free to use. OWASP Cornucopia is licensed under the Creative Commons Attribution-ShareAlike 4.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar licence to this one.

© 2012-2025 OWASP Foundation. The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software.