What is cornucopia?

OWASP Cornucopia is a card game that helps software development teams figure out their security requirements. Instead of reading through dry checklists or compliance documents, your team plays a hands-on game that surfaces potential vulnerabilities and sparks conversations about what security measures you actually need to build. The game works by presenting players with various security threats and scenarios mapped to established industry standards. Each card cross-references resources like the OWASP Top 10 lists, mobile app security standards, AI security guidelines, and threat modeling frameworks. This means that while you're playing a game, you're actually walking through a structured catalog of real-world security concerns, from common web vulnerabilities to emerging risks in AI and large language models. The repo itself contains the source files and Python-based tools needed to generate these card decks in multiple languages, along with the code for a companion website where you can browse the cards online. The primary audience is product managers, founders, and development teams who want to integrate security thinking into their process without making everyone read specification documents. If you're running an agile startup and want your engineers to proactively think about security threats before shipping features, sitting down with this card game is a practical way to start that conversation. It's also useful for security advocates trying to get non-security folks engaged with threat modeling. A few things stand out about how the project is organized. Beyond the physical cards, there's an online game engine called Copi that lets remote teams play together digitally. The repo also includes detailed printing specifications, from paper weight to card dimensions, so organizations can produce professional-quality physical decks. The project pulls together an impressive number of external security frameworks into one playable format, making it a practical aggregation of widely-respected security knowledge rather than a single team's opinion on what matters.