trans: Add Panjabi (pa-IN) translation of AISVS 1.0

[GeeksikhSecurity]

Pull Request: Panjabi Translation of AISVS 1.0

Summary

This PR introduces the first Panjabi (ਪੰਜਾਬੀ) translation of OWASP AISVS 1.0, reaching 130+ million Panjabi speakers worldwide. Every section is bilingual — English first, Panjabi (Gurmukhi script) immediately below — so readers can cross-reference for technical precision. The translation follows the same bilingual methodology as the OWASP ASVS 5.0 Panjabi translation (PR #3254).

Status

Complete draft — all 18 source files translated (3 front matter + 12 control-family chapters + 3 appendices). This has not yet had a Panjabi-speaking sangat (community) review pass — see "How to Review" below. Submitting now, in the open, so that review can happen against a real PR rather than a private draft.

Files Added

1.0/pa-IN/
├── 0x01-Frontispiece.md
├── 0x02-Preface.md
├── 0x03-Using-AISVS.md
├── 0x10-C01-Training-Data-Integrity-and-Traceability.md
├── 0x10-C02-Input-Validation.md
├── 0x10-C03-Model-Lifecycle-Management.md
├── 0x10-C04-Infrastructure.md
├── 0x10-C05-Access-Control-and-Identity.md
├── 0x10-C06-Supply-Chain.md
├── 0x10-C07-Model-Behavior.md
├── 0x10-C08-Memory-Embeddings-and-Vector-Database.md
├── 0x10-C09-Orchestration-and-Agentic-Action.md
├── 0x10-C10-MCP-Security.md
├── 0x10-C11-Adversarial-Robustness.md
├── 0x10-C12-Monitoring-and-Logging.md
├── 0x90-Appendix-A_Glossary.md
├── 0x91-Appendix-B_AI_Security_Controls_Inventory.md
├── 0x92-Appendix-C_AI_for_Code_Generation.md
├── CLAUDE.md              # translation rules (dictionary sources, Gurmat-safety constraints)
├── GLOSSARY.md            # shared terminology reference
├── OPEN-QUESTIONS.md      # terminology judgment-call log, cites the English source term
└── TRANSLATION-RULES.md

Terminology Approach

Each security term is classified as:

Type	When to Use	Example
Translated (T)	Natural Panjabi equivalent exists	Authentication → ਪ੍ਰਮਾਣੀਕਰਨ
Loan Word (L)	Term is universal in English	API → ਏ.ਪੀ.ਆਈ.
Retained (R)	Acronym or proper noun	OWASP, LLM, MCP
Hybrid (H)	Part translates, part stays	Prompt Injection → ਪ੍ਰੌਮਪਟ ਇੰਜੈਕਸ਼ਨ

Terminology judgment calls (new AI-security vocabulary not covered by the ASVS glossary) are logged in OPEN-QUESTIONS.md with the English source term, the pick, and the reasoning — same format as the ASVS translation's terminology log.

Mechanical Verification

Every file passes zero-dependency lint checks before being marked complete: requirement-ID completeness against the English source, orthography (no Devanagari contamination, Western numerals), modal-strength consistency (must/must-not), and spelling-consistency against a 177k-word Panjabi Wikipedia frequency list. These are hypothesis-generating checks, not a substitute for human sangat review.

How to Review

• No GitHub experience needed: Email gurvinder@securityleader.ai with subject "AISVS Panjabi Review"
• GitHub users: Leave inline comments on any file in 1.0/pa-IN/

Related

• Sibling translation: OWASP ASVS 5.0 Panjabi (PR #3254), same bilingual methodology and terminology framework
• Follows the pattern of existing OWASP translations into other languages

Maintainer

GeeksikhSecurity — committed to ongoing maintenance and community engagement

[jmanico]

Thanks @GeeksikhSecurity for this. Translating all 18 files, with the English kept alongside and the terminology choices logged, is a lot of careful work, and a Panjabi edition could reach a large new audience. I'm sorry it has taken us so long to reply.

To be upfront, we haven't yet decided how AISVS will publish translations. The main open questions are:

• which release translations should follow, now that 1.01 is in progress
• where translations should live, and which files belong in this repository
• what review a translation should have before we publish it

We'll keep this PR open and follow up here once we've decided. Thank you for your patience, and for offering to maintain the translation.

[jmanico]

In the world of AI with auto-translation, we are thinking of only publishing this in US_English and leave translations outside the repo. cc @ottosulin @RicoKomenda

[GeeksikhSecurity]

Thanks @jmanico, and no worries about the wait. I appreciate you laying out the open questions.

Rigor: this is not auto-translation. Rigor: this is not automatic translation. A person translates the 18 files with framework support using Claude, keeping English alongside, while terminology choices are recorded. A glossary and style guide manage recurring terms. Machine translation tends to drift on security terms (e.g., "compromise" in the breach sense mapped to a word meaning "agreement"), which is why I don't think it's a safe substitute for a standard whose controls people audit against.

Proposal on your three questions:

1. Which release: pin each translation to a specific AISVS version (currently 1.0). I'll rebase and update to 1.01 once it's stable, with the version stated at the top of every file.
2. Where it lives: either a translations/pa-IN/ directory marked non-normative, or hosted externally and linked from the AISVS site. English (US) remains the only authoritative text. I'm fine with either.
3. Review before publishing: a staged status on each translation: Draft, then Community-reviewed (Sikh/Panjabi-speaking practitioners and community), then Academic-reviewed (Panjabi linguistics and information-security academics). Only files with completed review would carry the higher labels, and reviewer names/affiliations would be recorded in the PR history.

If the project prefers to keep translations outside the repo, I'd still like a link from AISVS to the reviewed version. Happy to take on maintenance either way. Let me know what would make this easiest for you and @ottosulin and @RicoKomenda to decide.

[ottosulin]

I think that is actually a good point @jmanico, it is very easy for everyone to get their own translation now.

Also keeping possibly a dozen translations up to date is more overhead for already busy maintainers.

We can always also revisit this discussion later. I'd say this is our policy at least for 1.xx releases.