8.1.1 and 8.1.2 are pretty clear duplicates

[jmanico]

From https://github.com/OWASP/ASVS/blob/master/5.0/en/0x16-V8-Data-Protection.md

8.1.1	Verify the application protects sensitive data from being cached in server components such as load balancers and application caches.		✓	✓	524
8.1.2	Verify that all cached or temporary copies of sensitive data stored on the server are protected from unauthorized access or purged/invalidated after the authorized user accesses the sensitive data.		✓	✓	524

[elarlang]

is it different when we take away "cached" from 8.1.2? One seems to target load balancers and cache servers, other data (temporary copy) in the application.

[jmanico]

is it different when we take away "cached" from 8.1.2? One seems to target load balancers and cache servers, other data (temporary copy) in the application.

I think we can merge the two, the difference is so subtle I think it's not necessary.

[elarlang]

I don't mind. Those are presenting different test-cases but covering the same problem (and same level and same CWE)

[jmanico]

I do mind. We need a leaner standard. This level of redundancy for the secure building side of the house is distracting.

[tghosth]

Agree with merging

[danielcuthbert]

3rd agree. These two date back to a different web, and ideally we need a leaner standard

[tghosth]

Opened #1404, @jmanico please can you review