<!-- [rfced] Section 17 and Informative References. We could not find
the [OWASP] paper at <https://www.owasp.org/>. Perhaps the
reference should point to the website generally?
Current:
Various organizations maintain topical information and links to
current research on Web application security (e.g., [OWASP]).
...
[OWASP] van der Stock, A., Ed., "A Guide to Building Secure Web
Applications and Web Services", The Open Web Application
Security Project (OWASP) 2.0.1, 27 July 2005,
<https://www.owasp.org/>.
Perhaps:
[OWASP] The Open Web Application Security Project,
<https://www.owasp.org/>
-->