BY-LAWS OF
THE OWASP FOUNDATION, INC
ARTICLE I
NAME, PURPOSE, AND OFFICES
Section 1.1

Name

The name of the corporation is "The OWASP Foundation, Inc." and the corporation isreferred to in these By-laws as the "Foundation."
Section 1.2

Principal Office

The principal office of the Foundation shall be located at 401 Edgewater Place, Suite 600,
Wakefield, MA 01880. The Board of Directors of the Foundation (the "Board of Directors") is
hereby granted full power and authority to change its principal office from one location toanother, both within and without said state.
Section 1.3

Other Offices

Branch or subordinate offices may be established at or moved to any place or places, andclosed by the Board of Directors.
Section 1.4

PurposeThe nature of the business or purposes to be conducted or promoted by the Foundation isto engage in any lawful act or activity for which corporations that are organized not for profit
may be organized under the State of Delaware General Corporation Law ("DGCL"). The primary
purpose of the Foundation is to improve the state of software security. Specifically, theFoundation will: (i) support the building of impactful projects; (ii) develop and nurturecommunities through events and chapter meetings worldwide; (iii) provide educational
publications & resources; (iv) operate a branding program based upon distinctive trademarks tocreate high customer awareness, demand for, and confidence in the Foundation, its members,
projects, and activities; and (v) undertake such other activities as may from time to time beappropriate to further the purposes and achieve the goals set forth above.
In connection with the foregoing, the Foundation intends to engage in some or all of thefollowing activities, to: (a) drive the development of, disseminate, support and maintaindocuments, standards, guidelines, cheat sheets, and other projects; (b) maintain a membershipprogram; (c) administer grants and fundraising including donations, bequests, seeking grants,
hosting significant global events, activities, and trainings; (d) create and own distinctive
trademarks, service marks and/or certification marks; (e) administer or subcontract a branding
program; (f) create various printed and/or electronic materials for distribution to members and
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

non-members; (g) maintain its own website; (h) maintain relations with, and leverage standards
developed by, other standard setting organizations and industry consortia to ensure coherence
among specifications maintained by the Foundation and such other organizations; (i) maintain a
global chapter program; (j) operate committees as approved by the Board of Directors; and(k) undertake those other activities which its Board of Directors may from time to time approve.
Section 1.5

Non-profit Status(a)
The Foundation is organized and shall be operated as a non-stock membershipcorporation operating not for profit under the DGCL. The Foundation is organized exclusively
for charitable and educational purposes, including, for such purposes, the making of distributions
to organizations that qualify as exempt organizations described under Section 501(c)(3) of theInternal Revenue Code of 1986, as amended (hereinafter, the "Code"), or corresponding Sectionof any future federal tax code.
(b)
The Foundation claims exemption from Federal taxation for the Foundation
pursuant to Section 501(a) of the Code. Until such time, if ever, as such exemption is lost, theFoundation shall not knowingly engage directly or indirectly in any activity that it believes
would be likely to invalidate its status as an organization exempt from federal income taxation
under Section 501(a) of the Code as an organization described in Section 501(c)(3) of the Code.
All references to the Code contained herein are deemed to include corresponding provisions ofany future United States Internal Revenue Law.
(c)
In the event that such exemption is obtained and until such time, if ever, as such
exemption is denied or lost: (i) no part of the net earnings of the Foundation shall inure to thebenefit of, or be distributable to, any member of its Board of Directors, its officers, or otherprivate persons, except that the Foundation shall be authorized and empowered to pay reasonable
compensation for services rendered and to make payments and distributions in furtherance of the
purposes set forth herein; (ii) no substantial part of the activities of the Foundation shall be thecarrying on of propaganda or otherwise attempting to influence legislation, and the Foundation
shall not participate or intervene in (including the publication or distribution of statements) any
political campaign on behalf of (or in opposition to) any candidate for public office; (iii) theFoundation shall be operated and organized exclusively for charitable and educational purposes,
within the meaning of Section 501(c)(3) of the Code; and (iv) notwithstanding any otherprovisions of these By-laws, the Foundation shall not carry on any other activities not permitted
to be carried on (A) by an organization exempt from federal income tax under Section 501(c)(3)of the Code, or (B) by an organization contributions to which are deductible under Section
170(c)(2) of the Code.

2
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

ARTICLE II
MEMBERS
Section 2.1

Classes of Membership(a)
The Foundation has the following classes of Membership: Individual Members
and Complimentary Members. Individual Members and any future classes of members entitled tovoting rights shall be collectively referred to as "Voting Members." All voting and non-voting
memberships in the Foundation are collectively referred to in these By-laws as "Memberships."
In these By-laws, a person or entity holding Membership is referred to as a "Member."(b)
The Individual Member class has the following subclasses: Standard, Regional,
Student, Lifetime, and Distinguished Lifetime. Only the Board shall grant Distinguished
Lifetime Membership.
(c)
The Board of Directors may create additional classes or subclasses of voting andnon-voting Members in the future and may amend the rights of existing classes of Members ineach case in accordance with to Section 2.7 of these By-laws.
Section 2.2

General Conditions of Membership(a)
Any individual shall be admitted to Membership upon: (i) acceptance of its
written application on such form as may be from time to time required by the Foundation (which
acceptance shall be administered in a non-discriminatory fashion) and (ii) unless otherwise
provided by the Board of Directors, payment of such application fees, assessments, initiation fees
(if any), annual dues or other fees for such class or subclass of Membership as may from time totime be established by the Board of Directors (collectively, "Fees"); provided, however, that theFoundation (x) shall have no obligation to accept, nor shall it have any liability for refusing toaccept, any application for Membership, and (y) shall have the right to restrict the ability of any
Member to exercise any or all rights of Membership; in each case, to the extent that theFoundation reasonably believes on advice of legal counsel that it might violate any federal, stateor foreign law or regulation applicable to it by acting otherwise.
(b)
A Member shall remain in good standing as a Member, provided such Member
complies with the terms and conditions of the Foundation's Certificate of Incorporation("Certificate of Incorporation"), By-laws, Membership Application, and such rules and policies
as the Board of Directors and/or any committees thereof (each a "Board Committee") may fromtime to time adopt (collectively, “Foundation Policies”), including without limitation, timely
payment of all fees and penalties for late payment as may be determined by the Board of
Directors (such Fees and penalties are collectively referred to in the By-laws as "Financial
Obligations," and all of the foregoing good standing requirements are collectively referred to in
the By-laws as "Membership Obligations").
3
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

(c)For purposes of these By-laws, “Foundation Policies” shall include, without
limitation, the Foundation’s IPR Policy, Membership Policy, Elections Policy, Committees
Policy, Signatory Policy, Grant Policy (each as defined elsewhere in these By-laws), and anyother operational and/or good standing policies, such as grace periods and policies aroundtechnical failures, as from time to time adopted by the Board of Directors and/or any Board
Committee.
Section 2.3

Privileges of Individual Membership

Each Individual Member, while in good standing, shall be entitled to:(a)nominate representatives to run for election as members of the Board of Directors(each a "Director") in accordance with the then current Foundation policy regarding Foundationelections approved by the Board of Directors (the “Elections Policy”);(b)vote on a "one vote per Member" basis in elections of Directors in accordancewith the Elections Policy;(c)appoint one voting representative, on a “one vote per Member basis” to eachcommittee of the Members of the Foundation (each a “Member Committee”) and each SubGroup thereof (as defined in Section 5.5(b) below) that the Foundation may establish;(d)nominate representatives to run for election as officers of any Member Committeeof the Foundation (each a "Committee Officer");(e)vote on a "one vote per Member" basis in elections of the Committee Officers of
the Member Committees in which such Individual Member participates;(f)
vote to approve on a "one vote per Member" basis to establish Member
Committees and Sub-Groups in accordance with the then current Foundation “Committees
Policy” (if any) that has been approved by the Board of Directors (the “Committees Policy”);(g)attend and participate (on a one vote per Member basis) in all general and special
meetings of the Membership provided for in Article III of these By-laws;(h)vote on each matter submitted to a vote of the Voting Members;(i)

propose initiatives to be acted upon by the Foundation; and(j)all rights of the Complimentary Members other than the rights specified in
Section 2.4(a).
Section 2.4

Privileges of Complimentary Membership

4
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Each Complimentary Member, while in good standing, shall be entitled to:(a)attend (on a non-voting basis) all general and special meetings of the Membershipprovided for in Article III of these By-laws;(b)

propose initiatives to be acted upon by the Foundation;(c)receive such free or discounted services provided by the Foundation for such
Member’s Membership class as the Board of Directors may designate from time to time; and(d)such other benefits, rights, and privileges applicable to such Member's
Membership class as the Board of Directors may from time to time designate, including but notlimited to, the applicable Membership benefits set forth in the then current Foundation“Membership Policy” (if any) approved by the Board of Directors (the “Membership Policy”).
Section 2.5

Rights in Intellectual Property

All intellectual property submitted to or owned, adopted, or created by the Foundation,
including without limitation, any of the same which may be represented by any Specifications,other standards, guidelines, policies, procedures, or tests (collectively, "Intellectual Property"),shall be subject to such policies and procedures, including the Foundation's Intellectual Property
Rights Policy (the "IPR Policy") (if any), as may from time to time be adopted by the Board of
Directors.
Section 2.6

Related Parties, Etc.

(a)
Only the individual person that has been accepted as a Member of the Foundation
shall enjoy the rights and privileges of such Membership, and not such individual’s family
members, employer, or other company, partnership, corporation, organization, or other group or
entity of or with which such individual is a part or may be involved.
(b)Section 2.7

Memberships shall be non-transferable, non-salable and non-assignable.
Additional Classes of Members

The conditions, privileges, powers, and voting rights (if any) of any class of Members
may be changed, any class of Membership may be deleted, and one or more additional classes ofMembership may be created, and the conditions, voting rights (if any), powers and privileges ofeach such class may be prescribed, by the adoption of an amendment to these By-laws pursuant
to Article XV of the By-laws.
Section 2.8

Termination or Suspension of Membership

5
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Any Member may be suspended from Membership or have its Membership terminated by
the Board of Directors for failure to satisfy its Membership Obligations, for engaging in any
conduct, either within or without the Foundation, that is contrary to the interests of theFoundation or the advancement of the Foundation's business or industry goals, or as provided in
Section 2.2 of these By-laws (in any such case, other than conduct or actions taken in good faithreliance on Article XIV of these By-laws). Financial Obligations already paid shall not be
refundable upon any such termination or suspension. All Financial Obligations of such Memberthat may be accrued and unpaid as of such termination or suspension shall remain due andpayable. Except as provided in the last paragraph of this Section 2.8 or the preceding sentence,no termination or suspension of Membership for any other purpose shall be effective unless:(a)
The Member is given notice of the proposed termination or suspension ofMembership and the reasons therefor;(b)Such notice is delivered personally or by certified mail, return receipt requested,
or by a national or international overnight courier service, or by other notice per these By-laws,
sent to the last address of the Member shown on the Foundation's records;(c)
Except in the case of termination or suspension of Membership under Section 2.2
above, such notice is given at least thirty days before the effective date of the proposed
termination or suspension of Membership; and(d)Except in the case of termination or suspension of Membership for failure tosatisfy a Financial Obligation or under Section 2.2 above, such notice sets forth a procedure
determined by the Board of Directors (or other body authorized by the Board of Directors) todecide whether or not the proposed termination or suspension shall take place, whereby theMember is allowed to be heard by such body, either orally (and represented by counsel if theMember so desires, at its sole cost and expense) or in writing, not less than five days before theeffective date of the proposed termination or suspension.
Notwithstanding the foregoing, in the event of termination pursuant to Section 2.2 aboveor that the Board of Directors believes in good faith that a Member is engaging in willful
misconduct to the material detriment of the best interests of the Foundation and its Members, theBoard of Directors may suspend such Member's Membership immediately, provided that such
Member is otherwise afforded the protections provided for in subsections (a), (b) and (d) of thisSection 2.8.
Section 2.9

Resignation by Member

A Member may resign as a Member at any time. Any Financial Obligations already paidby such Member shall not be refundable in such event, and all such Financial Obligations of such
Member which may be accrued and unpaid as of such date shall remain due and payable.

6
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Section 2.10

Association Management Platform

The name and address of each Member shall be contained in a record to be maintained at
the principal office of the Foundation (the "Association Management Platform"). Termination of
any Membership shall be recorded in such record together with the date of such termination.
Each Member shall be responsible for apprising the Foundation in writing of all changes
to its name and address and of the names and addresses of all representatives of such Member
appointed to be members of Member Committees designated by such Member in its application
for Membership or to receive notices or to vote on behalf of such Member.
Section 2.11

Levy of Dues, Assessments, or Fees

The Foundation may levy dues, assessments, or fees upon its Members in such amounts
as may be approved from time to time by the Board of Directors. A Member, upon learning of
any increase in dues or of any levy of any assessments or fees, may avoid liability therefor by
resigning from Membership before the date such dues, assessments, or fees are due and payable,
except where the Member is, by contract with the Foundation or otherwise, independently andexplicitly liable for such dues, assessments or fees. No provision of the Certificate ofIncorporation or By-Laws of the Foundation authorizing such dues, assessments, or fees shall, of
itself, create such liability. In no event shall the failure of a Member to pay any dues orassessments give rise to any claim in favor of the Foundation for indirect or consequential
damages.
Section 2.12

Use of Names

Neither the Foundation nor any Member shall use the name of the other in any form of
publicity without the written permission of the other, provided that the Foundation and any
Member may each disclose and publicize such Member's Membership in the Foundation, and theAlliance may display the logo of a Member at the Alliance website.
ARTICLE III
MEETINGS OF MEMBERS
Section 3.1

Place of Meetings

All face to face meetings of the Members shall physically be held at such place within orwithout the State of Delaware, or as may otherwise be permitted by law, and at such time as may
be fixed from time to time by the Board of Directors or Executive Director, or if not so
designated, at the registered office of the Foundation.
Section 3.2

Annual Meeting
7
OWASP DRAFT BYLAWS 12th August 2022

1302631.6

Annual meetings of Members ordinarily shall be held by written consent pursuant
to Section 3.10. Notwithstanding the foregoing, however, the Board of Directors may call any
annual meeting to be held in person at such date and time as shall be designated from time totime by the Board of Directors or the Chairperson of the Board of Directors (the "Chair").
Pursuant to such written consent, or at such meeting, as applicable, the Voting Members shallelect a Board of Directors in accordance with Section 4.3 and shall transact such other businessas may properly be addressed by written consent, or at such meeting, as applicable.
Section 3.3

Special MeetingsSpecial meetings of the Members, for any purpose or purposes, may, unless otherwiseprescribed by statute or by the Certificate of Incorporation, be called by the Board of Directors,
the Executive Director, or the Secretary at the request in writing of a majority of the Directors
then in office, or at the request in writing of Voting Members entitled to vote at least ten percentof the aggregate votes of all Voting Members. Such request shall state the purpose or purposes ofthe proposed meeting. Business transacted at any special meeting shall be limited to mattersrelating to the purpose or purposes stated in the notice of meeting.
Upon request by any person or persons entitled to call a special meeting of the Voting
Members, the Executive Director, the Chairperson of the Board of Directors (the "Chairperson")(if any), the Vice-Chair, or the Secretary shall cause notice to be given within thirty days ofreceipt of such request.
Section 3.4

Notice of Meetings

Except as otherwise provided by law or these By-laws, a notice of each meeting of theMembers, annual or special, stating the place, if any, date and hour of the meeting, the means ofremote communication, if any, by which Members may be deemed to be present in person andvote at such meeting, and, in the case of a special meeting, the purpose or purposes for which themeeting is called, shall be given not less than ten or more than sixty days before the date of themeeting, to each Member entitled to attend such meeting.
Section 3.5

Voting List

The Officer (defined in Section 6.1) who has charge of the system of record for theFoundation shall prepare at least ten days before every meeting of Members, a complete list of
the Members entitled to vote at the meeting, arranged in alphabetical order, and showing theaddress of each such Member. Nothing contained in this Section shall require the Foundation to
include electronic mail addresses or other electronic contact information on such list. Such list
shall be open to the examination of any Member, for any purpose germane to the meeting, for aperiod of at least 10 days prior to the meeting: (i) on a reasonably accessible electronic network,
provided that the information required to gain access to such list is provided with the notice ofthe meeting, or (ii) during ordinary business hours, at the principal place of business of the8
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Foundation. If the Foundation determines to make the list available on an electronic network, theFoundation may take reasonable steps to ensure that such information is available only toMembers of the Foundation. If the meeting is to be held at a place, then the list shall be produced
and kept at the time and place of the meeting during the whole time thereof, and may beinspected by any Member who is present. If the meeting is to be held solely by means of remotecommunication, then the list shall also be open to the examination of any Member during thewhole time of the meeting on a reasonably accessible electronic network, and the information
required to access such list shall be provided with the notice of the meeting.
Section 3.6

QuorumExcept as otherwise provided by statute, the Certificate of Incorporation or these Bylaws, Voting Members entitled to vote more than ten percent of the aggregate votes of all Voting
Members (or such higher percentage of Voting Members as may be required by law, these Bylaws or the Certificate of Incorporation, to approve any action to be taken at such meeting),
present in person or represented by proxy, shall constitute a quorum at all meetings of theMembers for the transaction of business. Member Committees shall have the same rules relating
to quorum requirements and voting majorities as provided for in these By-laws, unless otherwise
approved by the affirmative vote of the Board of Directors, except as otherwise proved bystatute, the Certificate of Incorporation, or these By-laws.
Section 3.7

Adjournments

Any meeting of Members may be adjourned from time to time without notice to any
other time and to any other place, if any, at which a meeting of Members may be held underthese By-laws, which time and place, if any, thereof, and the means of remote communications,
if any, by which Members may be deemed to be present in person and vote at such adjourned
meeting shall be announced at the meeting by a majority of the Voting Members present inperson or represented by proxy and entitled to vote at such meeting (regardless of whether aquorum is present), or, if no Voting Member is present or represented by proxy, by any officer
entitled to preside at or to act as secretary of such meeting, without notice other thanannouncement at the meeting, until a quorum shall be present or represented. At such adjourned
meeting at which a quorum shall be present or represented, any business may be transacted
which might have been transacted at the original meeting. If the adjournment is for more than
thirty days, or if after the adjournment a new record date is fixed for the adjourned meeting, a
notice of the adjourned meeting shall be given to all Members entitled to vote at the meeting.
Section 3.8

Action at Meetings(a)When a quorum is present at any meeting of Members, in all matters other thanthe election of the Board of Directors, the vote of more than fifty percent of the aggregate votesof all Voting Members, present in person or represented by proxy at such meeting and entitled tovote on the question, shall decide any question brought before such meeting, unless the question
9
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

is one upon which, by express provision of law, the Certificate of Incorporation or these By-laws,
a different vote is required, in which case such express provision shall govern and control thedecision of such question. Members of the Board of Directors shall be elected by a plurality ofthe votes of the Voting Members present in person or represented by proxy at the meeting andentitled to vote thereon in accordance with the Elections Policy.
(b)
Notwithstanding Section 3.8(a), in all matters other than the election of the Boardof Directors, in the event that any vote is to be taken of a single class of Voting Members, then aquorum for such vote shall be not less than ten percent of the Voting Members of that class, andwhen such quorum is present, the vote of more than fifty percent of the aggregate votes of the
Voting Members of that class present in person or represented by proxy at such meeting andentitled to vote on the question, shall decide such question.
(c) In the event that the Voting Members shall desire to take any action at a meeting thatthey are permitted to take by these By-laws, the Certificate of Incorporation or applicable law,and such action would, by provision of these By-laws or any resolution adopted by the Board of
Directors, require a Super Majority Vote of the Board of Directors were such action to be takenby the Board of Directors, then the quorum required for such action shall be as specified in
Section 3.6 above, and the taking of such action by the Voting Members shall require theaffirmative vote of two-thirds of the Voting Members, present in person or represented by proxyat such meeting and entitled to vote on the question.
Section 3.9

Proxies

Each Member entitled to vote at a meeting of Members, or to express consent or dissent
to corporate action in writing without a meeting, may authorize another person or persons to act
for the Member by proxy, but no such proxy shall be voted or acted upon after three years fromits date, unless the proxy provides for a longer period. Without limiting the manner in which a
Member may authorize another person or persons to act for such Member as proxy pursuant tothis Section, the following shall constitute valid means by which a Member may grant such
authority:(c)
A Member may execute a writing authorizing another person or persons to act forsuch Member as proxy. Execution may be accomplished by the Member or such Member’s
authorized officer, director, employee or agent signing such writing or causing such person's
signature to be affixed to such writing by any reasonable means including, but not limited to, by
facsimile signature.
A Member may authorize another person or persons to act for such Member as proxy bytransmitting or authorizing an electronic transmission to the person who will be the holder of theproxy or to a proxy solicitation firm, proxy support service organization or like agent duly
authorized by the person who will be the holder of the proxy to receive such transmission,
provided that any such electronic transmission must either set forth or be submitted with
10
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

information from which it can be determined that the electronic transmission was authorized by
the Member. If it is determined that such electronic transmissions are valid, the inspectors or, if
there are no inspectors, such other persons making that determination shall specify the
information upon which they relied.
Section 3.10

Action Without Meeting

Any action required to be taken at any annual or special meeting of Members, or any
action which may be taken at any annual or special meeting of a Member Committee, Sub-Group
thereof, or other group of Members or subset of Members, may be taken without prior notice andwithout a vote, if a consent in writing, setting forth the action to be taken, shall be signed by
Members (or members of a class of Members, as the case may be) making up not less than thatpercentage of all Members as would be necessary to authorize or take such action at a meeting at
which all Members (or class of Members, as the case may be) entitled to vote thereon were
present and voted. Prompt notice of the taking of the corporate action without a meeting by lessthan unanimous written consent shall be given to those otherwise entitled to vote thereon who
have not consented in writing.
An electronic transmission consenting to an action to be taken and transmitted by aMember or proxyholder, or by a person or persons authorized to act for a Member or
proxyholder, shall be deemed to be written and signed for the purposes of this Section, provided
that any such electronic transmission sets forth or is delivered with information from which theFoundation can determine (A) that the electronic transmission was transmitted by the Member or
proxyholder or by a person or persons authorized to act for the Member or proxyholder and(B) the date on which such Member or proxyholder or authorized person or persons transmitted
such electronic transmission.
A consent given by electronic transmission is delivered to the Foundation upon theearliest of: (i) when the consent enters and information processing system, if any, designated by
the Foundation for receiving consents, so long as the electronic transmission is in a form capableof being processed by that system and the Foundation is able to retrieve that electronictransmission; (ii) when a paper reproduction of the consent is delivered to the Foundation's
principal place of business or an officer or agent of the Foundation having custody of the book inwhich proceedings of meetings of Members are recorded; (iii) when a paper reproduction of theconsent is delivered to the Foundation's registered office in the State of Delaware by hand or bycertified or registered mail, return receipt requested; or (iv) when delivered in such other manner,
if any, provided by resolution of the Board of Directors of the Foundation. A consent given byelectronic transmission is delivered under this provision even if no person is aware of its receipt.
Receipt of an electronic acknowledgment from an information processing system establishes thatconsent given by electronic transmission was received but, by itself, does not establish that thecontent sent corresponds to the content received.

11
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Any copy, facsimile, or other reliable reproduction of a document (including any
electronic transmission) may be substituted or used in lieu of the original document for all
purposes for which the original document could be used, provided that such copy, facsimile, orother reproduction shall be a complete reproduction of the entire original document.
Section 3.11

Action Held by Remote Communication

If authorized by the Board of Directors in its sole discretion, and subject to suchguidelines and procedures as the Board of Directors may adopt, Members not physically present
at a meeting of Members may, by means of remote communication: (A) participate in a meetingof Members; and (B) be deemed present in person and vote at a meeting of Members whether
such meeting is to be held at a designated place or solely by means of remote communication,
provided that (i) the Foundation shall implement reasonable measures to verify that each person
deemed present and permitted to vote at the meeting by means of remote communication is a
Member or proxyholder, (ii) the Foundation shall implement reasonable measures to provide
such Members and proxyholders a reasonable opportunity to participate in the meeting and tovote on matters submitted to the Members, including an opportunity to read or hear theproceedings of the meeting substantially concurrently with such proceedings, and (iii) if any
Member or proxyholder votes or takes other action at the meeting by means of remotecommunication, a record of such vote or other action shall be maintained by the Foundation.
Section 3.12

Nomination and Election Procedures

Subject to the provisions of Section 4.3, the Board of Directors shall establish areasonable nomination and election policy given the nature, size, and operations of theFoundation, including a reasonable means for Members of appropriate classes to nominate aperson for election as a Director, a reasonable opportunity for a nominee to communicate to theMembers the nominee's qualifications and the reasons for the nominee's candidacy (if requested
by such nominee), a reasonable opportunity for all nominees to solicit votes (if requested by any
such nominee), and a reasonable opportunity for all Members entitled to vote thereon to choose
among the nominees.
Section 3.13

Order of Business

The order of business at all meetings of Members shall be as determined by the presiding
Officer, but the order of business to be followed at any meeting at which a quorum is present
may be changed by a vote of the Voting Members.
ARTICLE IV
DIRECTORS
Section 4.1

Powers12
OWASP DRAFT BYLAWS 12th August 2022

1302631.6

The business and affairs of the Foundation shall be managed by its Board of Directors,
which shall be, and shall possess all of the powers of, the "Governing Body" of the Foundation
as a non-stock membership corporation under the DGCL. The Board of Directors may exercise
all powers of the Foundation and do all such lawful acts and things, as are not by statute or by
the Certificate of Incorporation or by these By-laws, directed or required to be exercised or doneby the Members.
Section 4.2

Number of Directors

Subject to Section 4.4, the total number of Directors shall be at least five and not morethan nine.
Section 4.3

Nomination, Election and Term of Office of Directors(a)Each Individual Member (while remaining in good standing) shall be entitled tonominate a representative to run for election as a Director, and to vote with the other Individual
Members, voting as a class, in all elections of the Board Directors, per the number of vacancies
at each election, in accordance with the Elections Policy. Except as otherwise specified in theElections Policy or approved by the Board of Directors, each Director shall have a term of two
years, with a maximum of two terms in any ten year period, and thereafter, subject to Section
4.3(b) below.
(b)Subject to such rules as the Board of Directors may adopt to achieve staggered
Director terms, each Director shall hold office until the earliest to occur of (i) the expiration of
the term for which such Director was elected or appointed, as the case may be and such
Director's successor is elected and qualified; (ii) the expiration or termination of Membership ofthe Member that nominated such Director; or (iii) the death, resignation or removal of such
Director. In addition, during such times as the Membership of any Member that has arepresentative serving as a Director is suspended pursuant to Section 2.8 above, the attendance
and voting rights of such Director representative shall also be suspended until such time, if ever,as such suspension is lifted.
(c)
The Board of Directors may approve from time to time such reasonableattendance and other requirements as it shall deem to be advisable to ensure that seats on the
Board of Directors are held by active, contributing individuals. Such rules may provide that in
the event that such requirements have not been met, any Member that has nominated an
individual that has been elected to the Board of Directors may lose its ability to be represented
on the Board of Directors, and/or that a Director who fails to meet such requirements shall
automatically be deemed to have resigned from the Board of Directors, but no such rule may be
imposed retroactively.
Section 4.4

Enlargement or Reduction

13
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Subject to Section 2.7 above, the number of Directors, the persons eligible to become
Directors and the classes of Members eligible to elect and/or nominate Directors may beamended at any time by a Super Majority Vote of the Board of Directors or by a vote of the
Voting Members in accordance with Section 3.8(c).
Section 4.5

Resignation and Removal

Any Director may resign at any time upon notice to the Foundation in writing or byelectronic transmission at the principal place of business of the Foundation or to the Executive
Director or Secretary. Such resignation shall be effective upon receipt unless it is specified to beeffective at some other time or upon the happening of some other event. Any Director who wasnominated and elected by a Member under Section 4.3 may be removed by that Member. Any or
all the Directors who were elected by a class of Members voting as a class or by the Board of
Directors may be removed by a majority vote of such class of Members or Board of Directors,
respectively. Unless otherwise specified by law or the Certificate of Incorporation, any Director
may be removed by a majority of the other Directors then in office for engaging in any conduct,either within or without the Foundation, that is contrary to the interests of the Foundation or to
the advancement of the Foundation's business or industry goals; provided, however, that theMember or class of Members that designated and elected or nominated and elected (as the casemay be) such removed Director shall be entitled to designate and elect or nominate and elect (asthe case may be) a replacement for such removed Director to serve for the balance of such
removed Director's term.
Section 4.6

Vacancies(a)
Except as set forth in Section 4.3(c), a vacancy on the Board of Directors
occurring because of the death, resignation or removal of a Director may be filled by theMember that appointed or nominated and elected, as appropriate, such Director. Vacancies on the
Board of Directors occurring by reason of an expansion of the Board of Directors, unlessotherwise provided in the vote authorizing such expansion, shall be filled by the vote of amajority of Directors then in office, whether or not less than a quorum, or by a sole remaining
Director. The term of a Director so appointed or elected shall be the unexpired portion of theterm of the Director, if any, whom the Director so appointed or elected is replacing.
(b)
In the event and during the continuance of a vacancy in the Board of Directors,
the remaining Directors, except as otherwise provided by law or these By-laws, may exercise thepowers of the full Board of Directors until the vacancy is filled.
Section 4.7

Place of Meetings

The Board of Directors may hold meetings, both regular and special, either within orwithout the State of Delaware.

14
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Section 4.8

Regular Meetings

Regular meetings of the Board of Directors may be held without notice at such time andat such place as shall from time to time be determined by the Board of Directors; provided thatany Director who is absent when such a determination is made shall be given prompt notice ofsuch determination. A regular meeting of the Board of Directors may be held without notice
immediately after and at the same place as the annual meeting of Members.
Section 4.9

Special MeetingsSpecial meetings of the Board of Directors may be called by the Executive Director,
Chair, Vice Chair, Secretary, or on the written request of two or more Directors, or by one
Director if there is only one Director in office. Notice shall be given to each Director in person,by telephone, or by facsimile, electronic mail or other form of electronic communications, sent tosuch Director's address as it appears on the records of the Foundation, at least twenty-four (24)hours in advance of the meeting, or by written notice mailed to each Directors address at least
forty-eight (48) hours in advance of the meeting. A notice need not specify the purposes of themeeting.
Section 4.10

Quorum, Action at Meeting, Adjournments(a)Except where a Super Majority Vote is required under these By-laws, at all
meetings of the Board of Directors a majority of Directors then in office, shall constitute a
quorum for the transaction of business and the act of a majority of such Directors present at any
meeting at which there is a quorum shall be the act of the Board of Directors, except as may beotherwise specifically provided by law, the Certificate of Incorporation or these By-laws.
(b)
To pass a "Super Majority Vote", a resolution must be taken at a meeting of theBoard of Directors at which at least two-thirds of the Directors then in office are present andparticipating and in support of which at least two-thirds of the Directors then in office have voted
affirmatively, or by an equivalent number of Directors acting by written consent in the manner
described in Section 4.11 below. A Super Majority Vote of the Board of Directors shall be
required with respect to the following matters:(i)Amending or repealing any provision of these By-laws;(ii)

Amending the Certificate of Incorporation;(iii) Adopting or recommending to the Voting Members an agreement ofmerger or consolidation;(iv)
Approving or recommending to the Members the sale, lease or exchangeof all or substantially all of the Foundation's property and assets;
15
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

(v)Approving or recommending to the Members the dissolution, liquidation
or winding up of the Foundation or revocation of any such dissolution, liquidation or winding
up;
(vi)

Enlarging or reducing the size of the Board of Directors;(vii) Amending or modifying the eligibility requirements for Membership on
the Board of Directors or the classes of Members eligible to nominate and elect Directors;(viii) Adopting, amending, or repealing any Foundation Policy, including but
not limited to the Elections Policy, IPR Policy, Membership Policy, Committees Policy,
Signatory Policy and Grant Policy;(ix)
Delegation of any responsibility of duty of the Board of Directors to any
Member Committee or Board Committee (by approval of a Member Committee charter orotherwise); and(x)
Any other matter specifically requiring a Super Majority Vote of theBoard of Directors pursuant to these By-laws.
(c)
No Director whose attendance and voting rights have been suspended shall becounted for purposes of determining quorum, the number of Directors then in office or thenumber of Directors required for voting purposes, unless otherwise required by law, these Bylaws, or the Certificate of Incorporation. If a quorum shall not be present at any meeting of theBoard of Directors, a majority of the Directors present thereat may adjourn the meeting fromtime to time, without notice other than announcement at the meeting, until a quorum shall bepresent. If one or more of the Directors shall be disqualified from voting at any meeting upon
any matter, then the required quorum as it relates to the consideration of such matter shall be
reduced by one for each such Director so disqualified.
Section 4.11

Action by Consent(a)Unless otherwise restricted by the Certificate of Incorporation or these By-laws,
any action required or permitted to be taken by the Board of Directors may be taken without ameeting and without prior notice if a majority of Directors then in office (or such greater number
of Directors as may be required by law or the By-laws of the Foundation for the taking of any
such action at a meeting) consent thereto in writing or by electronic transmission, so long as:(i)such written consent shall have been sent simultaneously to all Directors
then in office for their consideration;(ii)
prompt written notice of any action so taken is given to those Directors
who have not consented in writing or by electronic transmission; and16
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

(iii) two or more such Directors have not objected to the taking of any suchaction by written notice delivered to the Foundation within ten business days following the datethat written notice of the Directors action is mailed or otherwise delivered to such Directors.
After an action is taken, the consent or consents relating thereto shall be filed with the minutes ofthe proceedings of the Board of Directors, in the same paper or electronic form as the minutes
are maintained.
(b)
Notwithstanding the foregoing, the ability of two or more non-consenting
Directors to prevent the taking of an action by written consent under clause 4.11(a)(iii) above
shall not prevent any such action from being taken later at an actual meeting of the Board of
Directors.
(c)Unless otherwise restricted by the Certificate of Incorporation or these By-laws,
any action required or permitted to be taken at any meeting of any Board Committee may betaken in the manner set forth in the preceding clauses 4.11(a) and (b).
Section 4.12

Remote Meetings

Unless otherwise restricted by the Certificate of Incorporation or these By-laws, membersof the Board of Directors or of any Board Committee may participate in a meeting of the Boardof Directors or of any Board Committee, as the case may be, by means of conference telephone,
video conference equipment, or other communications equipment by means of which all persons
participating in the meeting can hear each other, and such participation in a meeting shallconstitute presence in person at the meeting.
Section 4.13

Inspection Rights

Every Director shall have the absolute right at any time to inspect, copy and makeextracts of, in person or by agent or attorney, all books, records and documents of every kind,and to inspect the physical properties of the Foundation.
Section 4.14

Fees and Compensation

Directors shall not receive any stated salary or reimbursements for their services as
Directors; provided that, by resolution of a majority of the Board of Directors, the Foundation
may reimburse Directors for expenses incurred while acting on behalf of the Foundation and/or
expenses incurred in attending meetings of the Board of Directors, in such amounts as the Boardof Directors may determine to be appropriate. Nothing herein contained shall be construed topreclude any Director from serving the Foundation in any other capacity as an Officer, agent,employee or otherwise, and receiving compensation therefor. The Board of Directors may also
approve reimbursement of expenses for members of Board Committees in connection with theirservice on such Board Committees.
17
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

ARTICLE V
EXECUTIVE COMMITTEE AND OTHER COMMITTEES
Section 5.1

Executive Committee

The Board of Directors may (but shall not be required), by resolution adopted by amajority of the Directors then in office (provided a quorum is present), create an Executive
Committee, consisting of one or more Directors. The Board of Directors may designate one ormore Directors as alternate members of such Executive Committee, who may replace any absent
member at any meeting of such Executive Committee. The Executive Committee, subject to any
limitations imposed by the Certificate of Incorporation, these By-laws, statute and/or resolution
adopted by the Board of Directors, shall have and may exercise all of the powers of the Board of
Directors which are delegated to the Executive Committee from time to time by the Board of
Directors; provided, however, that the Executive Committee shall have no authority with respectto:(d)Approving any action which requires approval of the Voting Members;(e)Filling vacancies on the Board of Directors;(f)Fixing compensation of the Directors for serving on the Board of Directors or on
any Board Committee;(g)
Amending or repealing any resolution of the Board of Directors which by its
express terms is not so amendable or repealable;(h)Taking any other action at any time reserved solely to the full Board of Directors
under the DGCL; and(i)Adopting any resolution or approving any action that requires a Super Majority
Vote under these By-Laws.
Section 5.2

Other Committees of the Board of Directors

The Board of Directors may create such nominating, audit, compensation and other
Board Committees, each consisting of one or more Directors appointed by the Board of
Directors, as the Board of Directors may from time to time deem advisable, to perform suchgeneral or special duties as may from time to time be delegated to any such Board Committees
by the Board of Directors, subject to the limitations imposed by the Certificate of Incorporation
or by these By-laws. No such Committee shall have the power or authority to take any action
prohibited by Section 5.1 above to be taken by the Executive Committee. The Board of Directors
may designate one or more Directors as alternate members of any Board Committees, who may
replace any absent member at any meeting of such Board Committees. Any such Board
18
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Committee or Board Committees shall have such powers, duties and name or names as may be
determined from time to time by resolution adopted by the Board of Directors. Each Board
Committee shall keep regular minutes of its meetings and make such reports to the Board of
Directors as the Board of Directors may request.
Section 5.3

Meetings of Committees of the Board of Directors

Except as otherwise provided in these By-laws or by resolution of the Board of Directors,
each Board Committee may adopt its own rules governing the time and place of holding and themethod of calling its meetings and the conduct of its proceedings and shall meet as provided bysuch rules, but unless otherwise provided by resolution of the Board of Directors or in such rules,
its business shall be conducted as nearly as possible in the same manner as is provided in theseBy-laws for the conduct of the business of the Board of Directors.
Section 5.4

Term of Office of Members of Committees of the Board of Directors

Each member of a Board Committee shall serve for such term as shall be established at
the time of his or her election in accordance with the Elections Policy .
Section 5.5

Committees of the Members(a)
A Project Committee of the Foundation is hereby established, which may havesuch Sub-Groups as from time to time may be approved by the Board of Directors. The Project
Committee and its Sub-Groups shall be the principal Member-level forum for the discussion andpreliminary adoption of technical strategy and standards, subject to the review, and within thestrategic direction established by, the Board of Directors and such Member Committee shallotherwise have such rights and privileges as shall from time to time be established by the Boardof Directors, or as set forth in such Project Committee charter, rules, and policies as shall havebeen previously adopted by the Board of Directors. The Project Committee may make technicalrecommendations to the Board of Directors concerning technical strategy and other technicalwork products of the Foundation and may undertake such other tasks as may from time to time
be established by the Board of Directors, provided that all strategies and standards may only be
finally adopted by the Board of Directors.
(b)
From time to time, the Board of Directors may establish additional Member
Committees. Each Member, so long as it remains a Member in good standing, shall be entitled toappoint such representatives to each such Member Committee, with such voting rights (if any),
as set forth in Article II. Unless otherwise specified in these By-laws or by the Board of
Directors, each Member Committee may have such sub-groups, working groups, and othergroups as from time to time may be approved by such Member Committee, within the strategic
direction established by the Board of Directors (each a "Sub-Group").
Member Committees are subject to the Committees Policy (if any).
19
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

ARTICLE VI
OFFICERS
Section 6.1

Officers

The officers of the Foundation (each an “Officer”) shall be a Chair, a Treasurer, and a
Secretary, each of which must also be a Director. The Foundation may also have at the discretionof the Board of Directors, a Vice Chair, an Executive Director, and such other Officers with such
titles, terms of office and duties as may be determined in accordance with the provisions ofSection 6.3. When the Foundation has a Chair, that individual shall preside over meetings of theBoard of Directors. One person may hold two or more offices unless the Certificate ofIncorporation, or these By-laws otherwise provide.
Section 6.2

Vacancies

A vacancy in any office because of death, resignation, removal, disqualification, or any
other cause shall be filled in the manner prescribed in these By-laws for regular elections to suchoffice and may be filled by the Board of Directors, at its discretion.
Section 6.3

Election

The Board of Directors at its first meeting after each annual election of Directors shallchoose a Chair, Treasurer, and Secretary. Other Officers may be elected by the Board of
Directors at such meeting, and any or all Officers may be replaced, at any other meeting of, or by
written consent of, the Board of Directors.
Section 6.4

TenureEach Officer of the Foundation shall hold office until his or her successor is chosen andqualifies, unless a different term is specified in the vote choosing or electing him, or until his or
her earlier (i) death, resignation or removal, or (ii) ceasing to be an employee of a Member
represented, or (iii) the termination of the Membership of the Member that is his or her
employer. Any officer elected by the Board of Directors may be removed at any time by the
Board of Directors or a Board Committee duly authorized to do so. Any officer may resign by
delivering his or her written resignation to the Foundation at its principal place of business or to
the Secretary. Such resignation shall be effective upon receipt unless it is specified to beeffective at some other time or upon the happening of some other event.
Section 6.5

Chair

The Chair shall have all the powers normally associated with the role of chief executive
officer and preside at all meetings of the Board of Directors and the Members. The Chair shall
20
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

oversee the management of the business of the Foundation and see that all orders and resolutionsof the Board of Directors are carried into effect. Without limiting the foregoing, the Chair shall:(a)Subject to the then current Foundation policy regarding Foundation signatureauthority (the “Signatory Policy”) that has been approved by the Board of Directors (if any),
execute bonds, mortgages, and other contracts, except where required or permitted by law to beotherwise signed and executed and except where the signing and execution thereof is governedby the Signatory Policy (if any) or is otherwise expressly delegated by the Board of Directors tosome other officer or agent of the Foundation; and(b)
Section 6.6

Oversee the Executive Director (if any).
Executive Director

The Executive Director (if any) shall be an ex officio member (in a non-voting capacity)of the Board of Directors, preside over the day-to-day affairs of the Foundation under the
direction of the Board of Directors, and perform such other duties and have such other powers as
the Board of Directors may from time to time prescribe.
Section 6.7

Secretary

The Secretary shall have such powers and perform such duties as are incident to theoffice of Secretary, and shall:(a)Prepare and maintain lists of Members and their addresses as required;(b)
Attend all meetings of the Board of Directors and all meetings of the Members
and record all the proceedings of the meetings of the Foundation and of the Board of Directors ina book to be kept for that purpose and perform like duties for the standing Board Committees
when required; and(c)Give, or cause to be given, notice of all meetings of the Members and special
meetings of the Board of Directors, and perform such other duties as may be from time to timeprescribed by the Board of Directors, and be under their supervision.
Section 6.8

Treasurer

The Treasurer (if any) shall perform such duties and shall have such powers as may be
assigned to him or her by the Board of Directors or the Chair. In addition, the Treasurer shallperform such duties and have such powers as are incident to the office of Treasurer. The
Treasurer shall have the custody of the corporate funds and securities and shall keep full andaccurate accounts of receipts and disbursements in books belonging to the Foundation and shalldeposit all moneys and other valuable effects in the name and to the credit of the Foundation insuch depositories as may be designated by the Board of Directors, taking proper vouchers for21
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

such disbursements, and shall render to the Chair and the Board of Directors, when the Chair orBoard of Directors so requires, an account of all his or her transactions as Treasurer and of thefinancial condition of the Foundation. Notwithstanding the foregoing, upon prior notice to theBoard, the Treasurer may delegate and supervise any or all the foregoing duties and actions to aperson or service provider retained by the Foundation.
Section 6.10

Compensation

The compensation, if any, of the Officers shall be fixed from time to time by the Board of
Directors, and no Officer shall be prevented from receiving such compensation by reason of thefact that the Officer is also a Director of the Foundation.
ARTICLE VII
NOTICES
Section 7.1

Delivery(d)Without limiting the manner by which notice otherwise may be given
effectively to Members, any notice to Members given by the Foundation under any provision of
the DGCL, the Certificate of Incorporation, or these By-laws may be given in writing directed to
the Member's mailing address (or by electronic transmission directed to the Member's electronic
mail address, as applicable) as it appears on the records of the Foundation and shall be given (1)if mailed, when the notice is deposited in the US mail, postage prepaid, (2) if delivered bycourier service, the earlier of when the notice is received or left at such Member's address or (3)if given by electronic mail, when directed to such Member's electronic mail address unless theMember has notified the Foundation in writing or by electronic transmission of an objection toreceiving notice by electronic mail or such notice is prohibited by subsection (e) of this Section.
A notice by electronic mail must include a prominent legend that the communication is an
important notice regarding the Foundation.
(e)Without limiting the manner by which notice otherwise may be given effectively
to Members, but subject to subsection (e) of this Section, any notice to Members given by theFoundation under any provision of the DGCL, the Certificate of Incorporation, or these By-laws
shall be effective if given by a form of electronic transmission consented to by the Members towhom the notice is given. Any such consent shall be revocable by the Member by written noticeor electronic transmission to the Foundation.
(f)Notice given pursuant to subsection (b) of this Section shall be deemed given:(1) if by facsimile telecommunication, when directed to a number at which the Member has
consented to receive notice; (2) if by a posting on an electronic network together with separate
notice to the Member or Director of such specific posting, upon the later of (A) such posting and

22
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

(B) the giving of such separate notice; and (3) if by any other form of electronic transmission,
when directed to the Member or Director.
(g)
For purposes of these By-laws, (1) "electronic transmission" means any form ofcommunication, not directly involving the physical transmission of paper, including the use of,or participation in, or one or more electronic networks or databases (including one or more
distributed electronic networks or databases), that creates a record that may be retained,
retrieved, and reviewed by a recipient thereof, and that may be directly reproduced in paper formby such a recipient through an automated process, (2) "electronic mail" means an electronictransmission directed to a unique electronic mail address (which electronic mail shall be deemed
to include any files attached thereto and any information hyperlinked to a website if suchelectronic mail includes the contact information of an officer or agent of the Foundation who isavailable to assist with accessing such files and information) and (3) "electronic mail address"
means a destination, commonly expressed as a string of characters, consisting of a unique username or mailbox (commonly referred to as the "local part" of the address) and a reference to aninternet domain (commonly referred to as the "domain part" of the address), whether or not
displayed, to which electronic mail can be sent or delivered.
(h)Notwithstanding the foregoing, a notice may not be given by an electronictransmission from and after the time that (1) the Foundation is unable to deliver by suchelectronic transmission two consecutive notices given by the Foundation and (2) such inability
becomes known to the Secretary or an assistant secretary of the Foundation or other person
responsible for the giving of notice, provided, however, the inadvertent failure to discover suchinability shall not invalidate any meeting or other action.
(i)Without limiting the foregoing, the Foundation adopts electronic mail as its
principal source of communication with its Members. Each Member acknowledges and agrees
that the Foundation shall not be under any obligation (except as required by law or these Bylaws) to send any notice to any Member by any means other than electronic mail, and it is,therefore, the responsibility of each Member to avail itself of and make such arrangements as
may be necessary to receive notice in such fashion.
(j)
An affidavit of the Secretary or an assistant secretary or of another agent of theFoundation that notice has been given shall, in the absence of fraud, be prima facie evidence ofthe facts stated therein.
Section 7.2

Waiver of Notice

Whenever any notice is required to be given under the provisions of law or of theCertificate of Incorporation or of these By-laws, a waiver thereof in writing, signed by the person
or persons entitled to said notice or a waiver by electronic transmission by the person entitled to
notice whether before or after the time stated therein, shall be deemed equivalent thereto.
Attendance of a person at a meeting shall constitute a waiver of notice of such meeting, except
23
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

when the person attends a meeting for the express purpose of objecting at the beginning of themeeting to the transaction of any business because the meeting is not lawfully called orconvened. Neither the business to be transacted at nor the purpose of any meeting needs to be
specified in any written waiver or any waiver by electronic transmission.
ARTICLE VIII
INDEMNIFICATION
Section 8.1

Actions other than by or in the Right of the Foundation

The Foundation shall indemnify any person who was or is a party or is threatened to bemade a party to any threatened, pending or completed action, suit or proceeding, whether civil,
criminal, administrative or investigative (other than an action by or in the right of theFoundation) by reason of the fact that he or she is or was a Director, Officer, employee or agentof the Foundation, or is or was serving at the request of the Foundation as a director, officer,
employee or agent of another corporation, partnership, joint venture, trust or other enterprise,against expenses (including attorneys' fees), judgments, fines and amounts paid in settlement
actually and reasonably incurred by him or her in connection with such action, suit or proceeding
if he or she acted in good faith and in a manner he or she reasonably believed to be in or not
opposed to the best interests of the Foundation, and, with respect to any criminal action orproceedings, had no reasonable cause to believe this conduct was unlawful. The termination of
any action, suit, or proceeding by judgment, order, settlement, conviction, or upon a plea of nolocontendere or its equivalent shall not, by itself, create a presumption that the person did not act ingood faith and in a manner which he or she reasonably believed to be in or not opposed to thebest interests of the Foundation, and, with respect to any criminal action or proceeding, hadreasonable cause to believe that his or her conduct was unlawful.
Section 8.2

Actions by or in the Right of the Foundation

The Foundation shall indemnify any person who was or is a party or is threatened to bemade a party to any threatened, pending or completed action or suit by or in the right of theFoundation to procure a judgment in its favor by reason of the fact that he or she is or was a
Director, Officer, employee or agent of the Foundation, or is or was serving at the request of theFoundation as a director, officer, employee or agent of another corporation, partnership, joint
venture, trust or other enterprise against expenses (including attorneys' fees) actually andreasonably incurred by him or her in connection with the defense or settlement of such action orsuit if he or she acted in good faith and in a manner he or she reasonably believed to be in or not
opposed to the best interests of the Foundation; provided, however, that no indemnification shallbe made in respect of any claim, issue or matter as to which such person shall have been
adjudged to be liable unless, and only to the extent that, the Court of Chancery of the State of
Delaware or the court in which such action or suit was brought shall determine upon application
that, despite the adjudication of liability but in view of all the circumstances of the case, such
24
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

person is fairly and reasonably entitled to indemnity for such expenses which the Court ofChancery of the State of Delaware or such other court shall deem proper.
Section 8.3

Success on the Merits

To the extent that any person described in Section 8.1 or 8.2 of this Article VIII has beensuccessful on the merits or otherwise in defense of any action, suit or proceeding referred to in
said Sections, or in defense of any claim, issue or matter therein, he or she shall be indemnified
against expenses (including attorneys' fees) actually and reasonably incurred by him or her inconnection therewith.
Section 8.4

Specific Authorization

Any indemnification under Section 8.1 or 8.2 of this Article VIII (unless ordered by acourt) shall be made by the Foundation only as authorized in the specific case upon adetermination that indemnification of any person described in said Sections is proper in thecircumstances because he or she has met the applicable standard of conduct set forth in said
Sections. Such determination shall be made (1) by a majority vote of a such Directors who were
not parties to such action, suit or proceeding, even though less than a quorum or (2) by theMembers of the Foundation.
Section 8.5

Advance Payment

Expenses incurred in defending a civil or criminal action, suit or proceeding may be paidby the Foundation in advance of the final disposition of such action, suit or proceeding uponreceipt of an undertaking by or on behalf of any person described in Section 8.1 or 8.2 above to
repay such amount if it shall ultimately be determined that he or she is not entitled toindemnification by the Foundation as authorized in this Article VIII.
Section 8.6

Non-Exclusivity

The indemnification and advancement of expenses provided by, or granted pursuant to,
the other Sections of this Article VIII shall not be deemed exclusive of any other rights to whichthose provided indemnification or advancement of expenses may be entitled under any By-law,agreement, vote of Voting Members or disinterested Directors or otherwise, both as to action in
his or her official capacity and as to action in another capacity while holding such office.
Section 8.7

Jurisdiction of Delaware Court of Chancery

The Delaware Court of Chancery is vested with exclusive jurisdiction to hear anddetermine all actions for advancement of expenses or indemnification. The Delaware Court ofChancery may summarily determine the Foundation's obligation to advance expenses (including
attorney's fees).
25
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Section 8.8

Insurance

The Board of Directors may authorize the Foundation to purchase and maintain insurance
on behalf of any person who is or was a Director, Officer, employee or agent of the Foundation,or is or was serving at the request of the Foundation as a director, Officer, employee or agent ofanother corporation, partnership, joint venture, trust or other enterprise against any liability
asserted against him or her and incurred by him or her in any such capacity, or arising out of hisor her status as such, whether or not the Foundation would have the power to indemnify him or
her against such liability under the provisions of this Article VIII.
Section 8.9

Continuation of Indemnification and Advancement of Expenses

The indemnification and advancement of expenses provided by, or granted pursuant to,this Article VIII shall continue as to a person who has ceased to be a Director, Officer, employee,
or agent of the Foundation and shall inure to the benefit of the heirs, executors andadministrators of such a person.
Section 8.10

Severability

If any word, clause or provision of this Article VIII or any award made hereunder shallfor any reason be determined to be invalid, the provisions hereof shall not otherwise be affected
thereby but shall remain in full force and effect.
Section 8.11

Intent of Article

The intent of this Article VIII is to provide for indemnification and advancement ofexpenses to the fullest extent permitted by Section 145 of the DGCL. To the extent that such
Section or any successor section may be amended or supplemented from time to time, this
Article VIII shall be amended automatically and construed to fully permit indemnification andadvancement of expenses from time to time permitted by law.
ARTICLE IXBOOKS AND RECORDS
Section 9.1

Books and Records

The Foundation shall keep adequate and correct books and records of account, minutes ofthe proceedings of the Members, the Board of Directors, and Board Committees, and a record of
the Members, including their names, addresses, and the class of Membership held by each.
Section 9.2

Form of Records

26
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Minutes and other books and records of the Foundation shall be kept either in written
form or in any other form capable of being converted into written form.
Section 9.3

Reports to Directors, Members and Others

The Board of Directors shall cause such reports to be prepared, filed and/or distributed as
may be required.
Section 9.4

Record Date

In order that the Foundation may determine the Members entitled to notice of or Voting
Members entitled to vote at any meeting of Members or any adjournment thereof, or to express
consent to corporate action in writing without a meeting, or entitled to receive payment of any
distribution, if any, permitted by law and the Foundation's then current federal and state tax
status, or allotment of any rights, or entitled to exercise any rights in respect of any change,
conversion or exchange of Membership or for the purpose of any other lawful action, the Boardof Directors may fix, in advance, a record date, which shall not be more than sixty days nor
fewer than ten days before the date of such meeting, nor prior to the adoption of the resolution by
the Board of Directors fixing such record date. A determination of Members of record entitled to
notice of or Voting Members entitled to vote at a meeting of Members shall apply to any
adjournment of the meeting; provided, however, that the Board of Directors may fix a newrecord date for the adjourned meeting. If no record date is fixed, the record date for determining
Members entitled to notice of or Voting Members entitled to vote at a meeting of Members shallbe at the close of business on the day before the day on which notice is given or, if notice iswaived, at the close of business on the day before the day on which the meeting is held. The
record date for determining Members entitled to express consent to corporate action in writing
without a meeting, when no prior action by the Board of Directors is necessary, shall be the dayon which the first written consent is delivered to the Foundation. The record date for determining
Members entitled to express consent to corporate action in writing without a meeting, when prioraction by the Board of Directors is necessary, shall be at the close of business on the day on
which the Board of Directors adopts the resolution taking such prior action.
Section 9.5

Registered Members

The Foundation shall be entitled to recognize the exclusive right of a person registered on
its books as a Member or a representative of a Member to receive distributions, if any, and tovote, if such records indicate that such person is a Voting Member or a representative of a Voting
Member, and to hold liable for Financial Obligations each Member registered on its books, andshall not be bound to recognize any equitable or other claim to or interest in Membership on thepart of any other person, whether or not it shall have express or other notice thereof, except asotherwise provided by the DGCL.

27
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

ARTICLE X
CERTAIN TRANSACTIONS
Section 10.1

Transactions with Interested Parties(a) No contract or transaction between the Foundation and one or more of its Directors or
Officers, or between the Foundation and any other corporation, partnership, association, or otherorganization in which one or more of its Directors or Officers are directors or officers, or have afinancial interest, shall be void or voidable solely for this reason, or solely because such Director
or Officer (or other director or officer) is present at or participates in the meeting of the Board of
Directors or Board Committee which authorizes the contract or transaction or solely because his,her or their votes are counted for such purpose, if:(i) The material facts as to his or her relationship or interest and as to the contract
or transaction are disclosed or are known to the Board of Directors or such Board Committee,
and the Board of Directors or such Board Committee in good faith authorizes the contract ortransaction by the affirmative votes of a majority of the disinterested Directors, even though thedisinterested Directors be less than a quorum; or(ii) The material facts as to his or her relationship or interest and as to thecontract or transaction are disclosed or are known to the Voting Members entitled to votethereon, and the contract or transaction is specifically approved in good faith by vote of the
Voting Members; or(iii) The contract or transaction is fair as to the Foundation as of the time it isauthorized, approved, or ratified, by the Board of Directors, a Board Committee, or the Voting
Members.
Common or interested Directors may be counted in determining the presence of a quorum at a
meeting of the Board of Directors or Board Committee that authorizes the contract ortransaction.
ARTICLE XIGRANTS, CONTRACTS, LOANS, ETC.
Section 11.1

GrantsThe making of grants and contributions, and otherwise rendering financial assistance forthe purposes of the Foundation, may be authorized by the Board of Directors and shall be subject
to the then current Foundation policy regarding the making of grants and/or contributions (asapplicable) approved by the Board of Directors (the “Grant Policy”) (if any). The Board of28
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

Directors may authorize any Officer or Officers, agent, or agents, in the name of and on behalf of
the Foundation to make any such grants, contributions or assistance.
Section 11.2

Execution of Contracts

The Board of Directors may authorize any Officer, employee or agent of the Foundation,in the name and on behalf of the Foundation, to enter into any contract or execute and satisfy any
instrument, and any such authority may be general or confined to specific instances, or otherwise
limited. In the absence of any action by the Board of Directors to the contrary, the Chair, Vice
Chair, and Executive Director shall be authorized to execute such contracts and instruments onbehalf of the Foundation.
Section 11.3

Checks, Drafts, Etc.

All checks, drafts and other orders for the payment of money out of the funds of theFoundation, and all notes or other evidences of indebtedness of the Foundation, shall be signed
on behalf of the Foundation in such manner as shall from time to time be determined byresolution of the Board of Directors.
Section 11.4

Deposits

Subject to the terms of the Signatory Policy (if any), the funds of the Foundation nototherwise employed shall be deposited from time to time to the order of the Foundation in suchbanks, trust companies, or other depositories, or shall be otherwise invested, as the Board of
Directors may select or direct, or as may be selected or directed by an Officer, employee or agentof the Foundation to whom such power may from time to time be specifically delegated by the
Board of Directors.
ARTICLE XIIDISSOLUTION
The Foundation may be dissolved upon Super Majority Vote of the Board of Directors,
provided that (i) such dissolution is otherwise approved and effected in compliance with the thencurrent requirements of the DGCL, and (ii) upon the dissolution of the organization, assets shallbe distributed for one or more exempt purposes within the meaning of Section 501(c)(3) of theInternal Revenue Code, or corresponding section of any future federal tax code, or shall be
distributed to the federal government, for a public purpose. Any such assets not disposed of shallbe disposed of by a court of competent jurisdiction in the county in which the principal office ofthe organization is then located, exclusively for such purposes or to such organization ororganizations, as said Court shall determine, which are organized and operated exclusively forsuch purposes.”29
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

ARTICLE XIII
GENERAL PROVISIONS
Section 13.1

Fiscal YearThe fiscal year of the Foundation shall be determined, and may be changed, by resolutionof the Board of Directors.
Section 13.2

Reserves

The Board of Directors may set apart out of any funds of the Foundation a reserve orreserves for any proper purpose and may abolish any such reserve.
Section 13.3

Proprietary Rights(a) Except as specifically provided to the contrary in such policies and procedures as
may from time to time be approved by the Board of Directors, all information disclosed by any
participant during any official meeting or activity of the Foundation, including but not limited toMember meetings, Member Committee Meetings, Sub-Group meetings, Board of Directors
meetings, meetings of Board Committees and sub-committees thereof, electronic mail or the like,shall be deemed to have been disclosed on a non-confidential basis, but without waiver of any
rights represented by valid patents, patent applications, and Federal and international statutory
copyrights.
(b) No express or implied right, whether by implication, estoppel, or otherwise, to any
patent, copyright, trademark, trade secret, or other intellectual property right of any Member is or
shall be deemed to be granted to the Foundation or to any other Member by reason of its
Membership in or participation in the activities of the Foundation, except as may be provided ina separate written agreement.
(c) No Member shall at any time be required to exchange proprietary information withany other Member solely by reason of its being a Member of the Foundation.
Section 13.4

Form of Records

Any records administered by or on behalf of the Foundation in the regular course of its
business, including its Membership list, books of account, and minute books, may be kept on, orby means of, or be in the form of, any information storage device, method, or one or more
electronic networks or databases (including one or more distributed electronic networks or
databases), provided that the records so kept can be converted into clearly legible paper form
within a reasonable time. The Foundation shall convert any records so kept into clearly legible
paper form upon the request of any person entitled to inspect such records pursuant to any
provision of the DGCL. When records are kept in such manner, a clearly legible paper form
30
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

prepared from or by means of the information storage device, method or one or more electronic
networks or databases (including one or more distributed electronic networks or databases) shallbe valid and admissible in evidence, and accepted for all other purposes, to the same extent as an
original paper record of the same information would have been, provided the paper form
accurately portrays the record.
Section 13.5

Document Form, Signature and Delivery

Without limiting the way any act or transaction may be documented, or the way a
document may be signed or delivered:(a) Any act or transaction contemplated or governed by the DGCL or the Certificate ofIncorporation or these By-laws may be provided for in a document, and an electronictransmission shall be deemed the equivalent of a written document. "Document" means (i) any
tangible medium on which information is inscribed, and includes handwritten, typed, printed orsimilar instruments, and copies of such instruments and (ii) an electronic transmission.
(b) Whenever the DGCL or the Certificate of Incorporation or these By-laws requires or
permits a signature, the signature may be a manual, facsimile, conformed or electronic signature.
"Electronic signature" means an electronic symbol or process that is attached to, or logicallyassociated with, a document and executed or adopted by a person with an intent to authenticate
or adopt the document.
(c) Unless otherwise agreed between the sender and recipient, an electronic transmission
shall be deemed delivered to a person for purposes of the DGCL and the Certificate ofIncorporation and By-laws when it enters an information processing system that the person has
designated for the purpose of receiving electronic transmissions of the type delivered, so long as
the electronic transmission is in a form capable of being processed by that system and such
person is able to retrieve the electronic transmission. An electronic transmission is delivered
under this Section even if no person is aware of its receipt. Receipt of an electronic
acknowledgement from an information processing system establishes that an electronictransmission was received but, by itself, does not establish that the content sent corresponds tothe content received.
This provision shall not prohibit one or more persons from conducting a transaction inaccordance with any electronic signature rules so long as the part or parts of the transaction thatare governed by the DGCL are documented, signed, and delivered in accordance with thisSection or otherwise in accordance with the DGCL. This Section shall apply solely for purposesof determining whether an act or transaction has been documented, and the document has beensigned and delivered, in accordance with the DGCL, the Certificate of Incorporation and theseBy-laws.

31
OWASP DRAFT BYLAWS 12th August 2022
1302631.6

ARTICLE XIV
ANTITRUST COMPLIANCE
Section 14.1

GeneralThe Foundation will conduct all its activities in conformance with all international, US
federal and state antitrust laws, including the Sherman Act, the Clayton Act, the RobinsonPatman Act, and the Federal Trade Commission Act. The Board of Directors and the Executive
Director shall consult legal counsel and seek legal review whenever necessary to insure that theactivities of the Foundation are conducted in conformance with such laws.
Section 14.2

Availability of Intellectual Property

It is the good faith objective of the Foundation (i) to make all Intellectual Property
available as soon as its development and adoption by the Foundation is complete on the sameterms to all Members who have not participated in the development or determination of such
Intellectual Property as well as to all those Members who have participated, (ii) to make all such
Intellectual Property available at the same point in time to all Members, and (iii) to make all such
Intellectual Property available to all non-Members on fair and reasonable terms and conditions.
Section 14.3

No Obligation to Endorse

No Member shall, by reason of its Membership or participation in the Foundation orotherwise, be obligated to license from the Foundation, use or endorse any Intellectual Property(as defined in Section 2.5) developed or endorsed by the Foundation, or to conform any of its
products to any Specification or standard developed or adopted by the Foundation, nor shall any
such Member be precluded from independently licensing, using or endorsing similar intellectual
property, software, specifications or documentation developed by it or by others.
ARTICLE XVAMENDMENTS
Except where such power is expressly limited by law, the Certificate of Incorporation orthese By-laws as to any specific action, these By-laws may be altered, amended or repealed, and
new By-laws may be adopted, in each case by an affirmative vote of (i) a Super Majority of theBoard of Directors or (ii) the Voting Members then in good standing in accordance with Section
3.8(c) of these By-laws, at any annual meeting of the Voting Members or regular meeting of theBoard of Directors or at any special meeting of the Voting Members or of the Board of Directors,
provided, however, that in the case of a regular or special meeting of Voting Members, notice ofsuch alteration, amendment, repeal or adoption of new By-laws shall be contained in the noticeof such meeting.
32
OWASP DRAFT BYLAWS 12th August 2022
1302631.6