Checklist template format

Reference for building your own checklist template file to bulk-import, instead of entering items one at a time in the UI.

JSON format

The top-level value is either a template object (what Export produces) or a bare list of item objects. Both import the same way.

Template object

Field	Required	Notes
format	No	redscribe-checklist-template. If present it must match
version	No	1. A file with a higher version is rejected, so a newer export is never half-read
name	No	Used when the Name box on the import form is left blank. If a template with that name already exists, the import is refused until you type the name into the Name box yourself, so a file can’t replace a template without you confirming it
description	No	Used when the Description box is left blank
is_default	No	Written by export for reference, ignored on import. Choose the default on the import form or the template list
items	Yes	A list of item objects, described next

Item objects

Field	Required	Type	Notes
category	Yes	string	Groups items in the run UI and in report output ({{ checklist_coverage }})
title	Yes	string	The item’s short name
code	No	string	A short reference code (e.g. WSTG-INFO-01). This is free text and isn’t validated against any external scheme
reference_info	No	string or object	The item’s objectives/description. Plain text is auto-wrapped into a single paragraph. For richer formatting (multiple paragraphs, links) pass a Tiptap document: either as a nested {"type":"doc","content":[...]} object, which is what export writes, or as that same JSON in a string

[
  {
    "category": "Information Gathering",
    "code": "WSTG-INFO-01",
    "title": "Conduct Search Engine Reconnaissance for Information Leakage",
    "reference_info": "Identify what sensitive design and configuration information of the application, system, or organization is exposed directly (on the organization's site) or indirectly (via third-party services). Reference: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/01-Conduct_Search_Engine_Reconnaissance_for_Information_Leakage"
  },
  {
    "category": "Information Gathering",
    "code": "WSTG-INFO-02",
    "title": "Fingerprint Web Server",
    "reference_info": "Determine the version and type of a running web server to enable further discovery of any known vulnerabilities. Reference: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server"
  }
]

A bad item stops the whole import with a message naming its row, and nothing is changed. Text fields have the same limits as in the UI: category 255 characters, code 32, title 500, and the template name 255. Item order in the run follows the array’s order. There’s no separate order field to set, so reorder items by reordering the array (or afterward in the UI via move).

Tip

docs/checklist-templates/owasp-wstg.json in the repo is a complete, ready-to-import worked example covering the full OWASP WSTG test list. The JSON snippet above is drawn directly from it.

CSV format

A header row plus one row per item. At minimum, category and title columns are required, and import is rejected outright if either is missing from the header. code and reference_info columns are optional.

category,code,title,reference_info
Information Gathering,WSTG-INFO-01,Conduct Search Engine Reconnaissance for Information Leakage,Identify what sensitive design and configuration information is exposed.
Information Gathering,WSTG-INFO-02,Fingerprint Web Server,Determine the version and type of a running web server.

What happens on import

Both formats go through the same underlying logic: the named template is created if it doesn’t already exist (matched by name), its description and uploader are updated, and every existing item on that template is deleted and replaced by the imported rows. A bulk import is a full replace, not a merge. reference_info content is sanitized the same way any other rich-text input is, regardless of import format: embedded images are removed, and links other than http, https and mailto are removed (the link text stays).

Caution

Re-importing into an existing template name discards its current items first. If you’ve hand-edited items in the UI since the last import and want to keep those edits, export the template first (JSON, same shape as the import format above) to capture its current state before re-importing.

Export format

Export on a template writes the template object described above: its name, description and default flag, plus every item (category, code, title, reference_info as a nested document) in the template’s current order. Importing that file on this or another instance recreates the same items and formatting, and fills in the name and description for you.

What a round trip doesn’t carry over:

• The default flag. Importing never changes which template is the default.
• Item identity. Items are recreated, so they get new internal IDs. Checklists already started from the template keep their own copy and aren’t affected.
• Images, and links other than http, https and mailto. These are removed on import. The template editor can’t add images to a Reference, so in practice this only affects hand-written files.
• Rich text in CSV. CSV has no way to express formatting, so it’s only suitable for plain-text references. Use JSON to keep formatting.

An item with no reference exports as an empty string and comes back as an empty document, which looks the same.

See also

• Checklists: the template/run workflow this format feeds into.