diff --git a/copi.owasp.org/lib/copi/migrations/card_migration.ex b/copi.owasp.org/lib/copi/migrations/card_migration.ex
index dbf92b9f0..9f36b9abd 100644
--- a/copi.owasp.org/lib/copi/migrations/card_migration.ex
+++ b/copi.owasp.org/lib/copi/migrations/card_migration.ex
@@ -46,6 +46,29 @@ defmodule Copi.CardMigration do
   end
 
 
+  def update_card_urls(path) do
+    case YamlElixir.read_from_file(path) do
+      {:ok, cards} ->
+        edition = cards["meta"]["edition"]
+        language = cards["meta"]["language"]
+        version = cards["meta"]["version"]
+        for suit <- cards["suits"] do
+          for card <- suit["cards"] do
+            if Map.has_key?(card, "url") do
+              value = to_string(card["value"])
+              existing_card = Repo.get_by(Card, category: suit["name"], value: value, edition: edition, language: language, version: version)
+
+              if existing_card do
+                existing_card
+                |> Ecto.Changeset.change(url: card["url"])
+                |> Repo.update!()
+              end
+            end
+          end
+        end
+    end
+  end
+
   defp map_cards(path) do
     case YamlElixir.read_from_file(path) do
       {:ok, cards} ->
diff --git a/copi.owasp.org/lib/copi_web/controllers/card_html/show.html.heex b/copi.owasp.org/lib/copi_web/controllers/card_html/show.html.heex
index 6b97ba818..66a464744 100644
--- a/copi.owasp.org/lib/copi_web/controllers/card_html/show.html.heex
+++ b/copi.owasp.org/lib/copi_web/controllers/card_html/show.html.heex
@@ -28,6 +28,9 @@
         <p class="category"><%= @card.category %></p>
 
         <p class="description"><%= @card.description %></p>
+        <%= if @card.url != nil and @card.url != "" do %>
+          <p class="description"><a class="info" rel="help noopener noreferrer" target="_blank" href={@card.url}>Need more info?</a></p>
+        <% end %>
 
         <%= if @card.value in ["J", "Q", "K"] do %>
 
diff --git a/copi.owasp.org/priv/repo/cornucopia/eop-cards-5.0-en.yaml b/copi.owasp.org/priv/repo/cornucopia/eop-cards-5.0-en.yaml
index 0474630b8..64ea79636 100644
--- a/copi.owasp.org/priv/repo/cornucopia/eop-cards-5.0-en.yaml
+++ b/copi.owasp.org/priv/repo/cornucopia/eop-cards-5.0-en.yaml
@@ -12,54 +12,67 @@ suits:
     - 
       id: "SP2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/SP2"
       desc: "An attacker could take over the port or socket that the server normally uses"
     - 
       id: "SP3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/SP3"
       desc: "An attacker could try one credential after another and there's nothing to slow them down (online or offline)"
     - 
       id: "SP4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/SP4"
       desc: "An attacker can anonymously connect, because we expect authentication to be done at a higher level"
     - 
       id: "SP5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/SP5"
       desc: "An attacker can confuse a client because there are too many ways to identify a server"
     - 
       id: "SP6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/SP6"
       desc: "An attacker can spoof a server because identifiers aren't stored on the client and checked for consistency on re-connection (that is, there's no key persistence)"
     - 
       id: "SP7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/SP7"
       desc: "An attacker can connect to a server or peer over a link that isn't authenticated (and encrypted)"
     - 
       id: "SP8"      
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/SP8"
       desc: "An attacker could steal credentials stored on the server and reuse them (for example, a key is stored in a world readable file)"
     - 
       id: "SP9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/SP9"
       desc: "An attacker who gets a password can reuse it (Use stronger authenticators)"
     - 
       id: "SPX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/SPX"
       desc: "An attacker can choose to use weaker or no authentication"
     - 
       id: "SPJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/SPJ"
       desc: "An attacker could steal credentials stored on the client and reuse them"
     - 
       id: "SPQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/SPQ"
       desc: "An attacker could go after the way credentials are updated or recovered (account recovery doesn't require disclosing the old password)"
     - 
       id: "SPK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/SPK"
       desc: "Your system ships with a default admin password, and doesn't force a change"
     - 
       id: "SPA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/SPA"
       desc: "You've invented a new Spoofing attack"
       misc: "Read more about this topic ..."
 -
@@ -69,54 +82,67 @@ suits:
     - 
       id: "TA2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/TA2"
       desc: "An attacker can take advantage of your custom key exchange or integrity control which you built instead of using standard crypto"
     - 
       id: "TA3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/TA3"
       desc: "An attacker can modify your build system and produce signed builds of your software"
     - 
       id: "TA4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/TA4"
       desc: "Your code makes access control decisions all over the place, rather than with a security kernel"
     - 
       id: "TA5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/TA5"
       desc: "An attacker can replay data without detection because your code doesn't provide timestamps or sequence numbers"
     - 
       id: "TA6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/TA6"
       desc: "An attacker can write to a data store your code relies on"
     - 
       id: "TA7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/TA7"
       desc: "An attacker can bypass permissions because you don't make names canonical before checking access permissions"
     - 
       id: "TA8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/TA8"
       desc: "An attacker can manipulate data because there's no integrity protection for data on the network"
     - 
       id: "TA9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/TA9"
       desc: "An attacker can provide or control state information"
     - 
       id: "TAX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/TAX"
       desc: "An attacker can alter information in a data store because it has weak/open permissions or includes a group which is equivalent to everyone (\"anyone with a Facebook account\")"
     - 
       id: "TAJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/TAJ"
       desc: "An attacker can write to some resource because permissions are granted to the world or there are no ACLs"
     - 
       id: "TAQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/TAQ"
       desc: "An attacker can change parameters over a trust boundary and after validation (for example, important parameters in a hidden field in HTML, or passing a pointer to critical memory)"
     - 
       id: "TAK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/TAK"
       desc: "An attacker can load code inside your process via an extension point"
     - 
       id: "TAA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/TAA"
       desc: "You've invented a new Tampering attack"
       misc: "Read more about this topic ..."
 -
@@ -126,54 +152,67 @@ suits:
     - 
       id: "RE2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/RE2"
       desc: "An attacker can pass data through the log to attack a log reader, and there's no documentation of what sorts of validation are done"
     - 
       id: "RE3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/RE3"
       desc: "A low privilege attacker can read interesting security information in the logs"
     - 
       id: "RE4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/RE4"
       desc: "An attacker can alter digital signatures because the digital signature system you're implementing is weak, or uses MACs where it should use a signature"
     - 
       id: "RE5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/RE5"
       desc: "An attacker can alter log messages on a network because they lack strong integrity controls"
     - 
       id: "RE6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/RE6"
       desc: "An attacker can create a log entry without a timestamp (or no log entry is timestamped)"
     - 
       id: "RE7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/RE7"
       desc: "An attacker can make the logs wrap around and lose data"
     - 
       id: "RE8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/RE8"
       desc: "An attacker can make a log lose or confuse security information"
     - 
       id: "RE9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/RE9"
       desc: "An attacker can use a shared key to authenticate as different principals, confusing the information in the logs"
     - 
       id: "REX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/REX"
       desc: "An attacker can get arbitrary data into logs from unauthenticated (or weakly authenticated) outsiders without validation"
     - 
       id: "REJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/REJ"
       desc: "An attacker can edit logs and there's no way to tell (perhaps because there's no heartbeat option for the logging system)"
     - 
       id: "REQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/REQ"
       desc: "An attacker can say \"I didn't do that,\" and you'd have no way to prove them wrong"
     - 
       id: "REK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/REK"
       desc: "The system has no logs"
     - 
       id: "REA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/REA"
       desc: "You've invented a new Repudiation attack"
       misc: "Read more about this topic ..."
 -
@@ -183,54 +222,67 @@ suits:
     - 
       id: "ID2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/ID2"
       desc: "An attacker can brute-force file encryption because there's no defense in place (example defense, password stretching)"
     - 
       id: "ID3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/ID3"
       desc: "An attacker can see error messages with security sensitive content"
     - 
       id: "ID4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/ID4"
       desc: "An attacker can read content because messages (say, an email or HTTP cookie) aren't encrypted even if the channel is encrypted"
     - 
       id: "ID5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/ID5"
       desc: "An attacker may be able to read a document or data because it's encrypted with a non-standard algorithm"
     - 
       id: "ID6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/ID6"
       desc: "An attacker can read data because it's hidden or occluded (for undo or change tracking) and the user might forget that it's there"
     - 
       id: "ID7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/ID7"
       desc: "An attacker can act as a 'man in the middle' because you don't authenticate endpoints of a network connection"
     - 
       id: "ID8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/ID8"
       desc: "An attacker can access information through a search indexer, logger, or other such mechanism"
     - 
       id: "ID9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/ID9"
       desc: "An attacker can read sensitive information in a file with permissive permissions"
     - 
       id: "IDX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/IDX"
       desc: "An attacker can read information in files or databases with no access controls"
     - 
       id: "IDJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/IDJ"
       desc: "An attacker can discover the fixed key being used to encrypt"
     - 
       id: "IDQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/IDQ"
       desc: "An attacker can read the entire channel because the channel (say, HTTP or SMTP) isn't encrypted"
     - 
       id: "IDK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/IDK"
       desc: "An attacker can read network information because there's no cryptography used"
     - 
       id: "IDA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/IDA"
       desc: "You've invented a new Information Disclosure attack"
       misc: "Read more about this topic ..."
 -
@@ -240,62 +292,75 @@ suits:
     - 
       id: "DS2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/DS2"
       desc: "An attacker can make your authentication system unusable or unavailable"
     - 
       id: "DS3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/DS3"
       desc: "An attacker can drain our easily replacable battery "
       misc: "(battery, temporary)"
     - 
       id: "DS4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/DS4"
       desc: "An attacker can drain a battery that's hard to replace (sealed in a phone, an implanted medical device, or in a hard to reach location) "
       misc: "(battery, persist)"
     - 
       id: "DS5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/DS5"
       desc: "An attacker can spend our cloud budget "
       misc: "(budget, persist)"
     - 
       id: "DS6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/DS6"
       desc: "An attacker can make a server unavailable or unusable without ever authenticating but the problem goes away when the attacker stops "
       misc: "(server, anonymous, temporary)"
     - 
       id: "DS7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/DS7"
       desc: "An attacker can make a client unavailable or unusable and the problem persists after the attacker goes away "
       misc: "(client, auth, persist)"
     - 
       id: "DS8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/DS8"
       desc: "An attacker can make a server unavailable or unusable and the problem persists after the attacker goes away "
       misc: "(server, auth, persist)"
     - 
       id: "DS9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/DS9"
       desc: "An attacker can make a client unavailable or unusable without ever authenticating and the problem persists after the attacker goes away "
       misc: "(client, anon, persist)"
     - 
       id: "DSX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/DSX"
       desc: "An attacker can make a server unavailable or unusable without ever authenticating and the problem persists after the attacker goes away "
       misc: "(server, anonymous, persistent)"
     - 
       id: "DSJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/DSJ"
       desc: "An attacker can cause the logging subsystem to stop working"
     - 
       id: "DSQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/DSQ"
       desc: "An attacker can amplify a Denial of Service attack through this component with amplification on the order of 10 to 1"
     - 
       id: "DSK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/DSK"
       desc: "An attacker can amplify a Denial of Service attack through this component with amplification on the order of 100 to 1"
     - 
       id: "DSA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/DSA"
       desc: "You've invented a new Denial of Service attack"
       misc: "Read more about this topic ..."
 -
@@ -305,54 +370,67 @@ suits:
     - 
       id: "EP2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/EP2"
       desc: "An attacker has compromised a key technology supplier"
     - 
       id: "EP3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/EP3"
       desc: "An attacker can access the cloud service which manages your devices"
     - 
       id: "EP4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/EP4"
       desc: "An attacker can escape from a container or other sandbox"
     - 
       id: "EP5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/EP5"
       desc: "An attacker can force data through different validation paths which give different results"
     - 
       id: "EP6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/EP6"
       desc: "An attacker could take advantage of permissions you set, but don't use"
     - 
       id: "EP7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/EP7"
       desc: "An attacker can provide a pointer across a trust boundary, rather than data which can be validated"
     - 
       id: "EP8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/EP8"
       desc: "An attacker can enter data that is checked while still under their control and used later on the other side of a trust boundary"
     - 
       id: "EP9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/EP9"
       desc: "There's no reasonable way for a caller to figure out what validation of tainted data you perform before passing it to them"
     - 
       id: "EPX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/EPX"
       desc: "There's no reasonable way for a caller to figure out what security assumptions you make"
     - 
       id: "EPJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/EPJ"
       desc: "An attacker can reflect input back to a user, like cross site scripting"
     - 
       id: "EPQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/EPQ"
       desc: "You include user-generated content within your page, possibly including the content of random URLs"
     - 
       id: "EPK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/EPK"
       desc: "An attacker can inject a command that the system will run at a higher privilege level"
     - 
       id: "EPA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/EPA"
       desc: "You've invented a new Elevation of Privilege attack"
       misc: "Read more about this topic ..."
 paragraphs:
diff --git a/copi.owasp.org/priv/repo/cornucopia/eop-cards-5.1-en.yaml b/copi.owasp.org/priv/repo/cornucopia/eop-cards-5.1-en.yaml
index 7144e7877..509e5a69b 100644
--- a/copi.owasp.org/priv/repo/cornucopia/eop-cards-5.1-en.yaml
+++ b/copi.owasp.org/priv/repo/cornucopia/eop-cards-5.1-en.yaml
@@ -12,54 +12,67 @@ suits:
     - 
       id: "SP2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/SP2"
       desc: "An attacker could take over the port or socket that the server normally uses"
     - 
       id: "SP3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/SP3"
       desc: "An attacker could try one credential after another and there's nothing to slow them down (online or offline)"
     - 
       id: "SP4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/SP4"
       desc: "An attacker can anonymously connect, because we expect authentication to be done at a higher level"
     - 
       id: "SP5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/SP5"
       desc: "An attacker can confuse a client because there are too many ways to identify a server"
     - 
       id: "SP6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/SP6"
       desc: "An attacker can spoof a server because identifiers aren't stored on the client and checked for consistency on re-connection (that is, there's no key persistence)"
     - 
       id: "SP7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/SP7"
       desc: "An attacker can connect to a server or peer over a link that isn't authenticated (and encrypted)"
     - 
       id: "SP8"      
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/SP8"
       desc: "An attacker could steal credentials stored on the server and reuse them (for example, a key is stored in a world readable file)"
     - 
       id: "SP9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/SP9"
       desc: "An attacker who gets a password can reuse it (Use stronger authenticators)"
     - 
       id: "SPX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/SPX"
       desc: "An attacker can choose to use weaker or no authentication"
     - 
       id: "SPJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/SPJ"
       desc: "An attacker could steal credentials stored on the client and reuse them"
     - 
       id: "SPQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/SPQ"
       desc: "An attacker could go after the way credentials are updated or recovered (account recovery doesn't require disclosing the old password)"
     - 
       id: "SPK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/SPK"
       desc: "Your system ships with a default admin password, and doesn't force a change"
     - 
       id: "SPA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/SPA"
       desc: "You've invented a new Spoofing attack"
       misc: "Read more about this topic ..."
 -
@@ -69,54 +82,67 @@ suits:
     - 
       id: "TA2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/TA2"
       desc: "An attacker can take advantage of your custom key exchange or integrity control which you built instead of using standard crypto"
     - 
       id: "TA3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/TA3"
       desc: "An attacker can modify your build system and produce signed builds of your software"
     - 
       id: "TA4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/TA4"
       desc: "Your code makes access control decisions all over the place, rather than with a security kernel"
     - 
       id: "TA5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/TA5"
       desc: "An attacker can replay data without detection because your code doesn't provide timestamps or sequence numbers"
     - 
       id: "TA6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/TA6"
       desc: "An attacker can write to a data store your code relies on"
     - 
       id: "TA7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/TA7"
       desc: "An attacker can bypass permissions because you don't make names canonical before checking access permissions"
     - 
       id: "TA8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/TA8"
       desc: "An attacker can manipulate data because there's no integrity protection for data on the network"
     - 
       id: "TA9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/TA9"
       desc: "An attacker can provide or control state information"
     - 
       id: "TAX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/TAX"
       desc: "An attacker can alter information in a data store because it has weak/open permissions or includes a group which is equivalent to everyone (\"anyone with a Facebook account\")"
     - 
       id: "TAJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/TAJ"
       desc: "An attacker can write to some resource because permissions are granted to the world or there are no ACLs"
     - 
       id: "TAQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/TAQ"
       desc: "An attacker can change parameters over a trust boundary and after validation (for example, important parameters in a hidden field in HTML, or passing a pointer to critical memory)"
     - 
       id: "TAK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/TAK"
       desc: "An attacker can load code inside your process via an extension point"
     - 
       id: "TAA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/TAA"
       desc: "You've invented a new Tampering attack"
       misc: "Read more about this topic ..."
 -
@@ -126,54 +152,67 @@ suits:
     - 
       id: "RE2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/RE2"
       desc: "An attacker can pass data through the log to attack a log reader, and there's no documentation of what sorts of validation are done"
     - 
       id: "RE3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/RE3"
       desc: "A low privilege attacker can read interesting security information in the logs"
     - 
       id: "RE4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/RE4"
       desc: "An attacker can alter digital signatures because the digital signature system you're implementing is weak, or uses MACs where it should use a signature"
     - 
       id: "RE5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/RE5"
       desc: "An attacker can alter log messages on a network because they lack strong integrity controls"
     - 
       id: "RE6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/RE6"
       desc: "An attacker can create a log entry without a timestamp (or no log entry is timestamped)"
     - 
       id: "RE7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/RE7"
       desc: "An attacker can make the logs wrap around and lose data"
     - 
       id: "RE8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/RE8"
       desc: "An attacker can make a log lose or confuse security information"
     - 
       id: "RE9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/RE9"
       desc: "An attacker can use a shared key to authenticate as different principals, confusing the information in the logs"
     - 
       id: "REX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/REX"
       desc: "An attacker can get arbitrary data into logs from unauthenticated (or weakly authenticated) outsiders without validation"
     - 
       id: "REJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/REJ"
       desc: "An attacker can edit logs and there's no way to tell (perhaps because there's no heartbeat option for the logging system)"
     - 
       id: "REQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/REQ"
       desc: "An attacker can say \"I didn't do that,\" and you'd have no way to prove them wrong"
     - 
       id: "REK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/REK"
       desc: "The system has no logs"
     - 
       id: "REA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/REA"
       desc: "You've invented a new Repudiation attack"
       misc: "Read more about this topic ..."
 -
@@ -183,54 +222,67 @@ suits:
     - 
       id: "ID2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/ID2"
       desc: "An attacker can brute-force file encryption because there's no defense in place (example defense, password stretching)"
     - 
       id: "ID3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/ID3"
       desc: "An attacker can see error messages with security sensitive content"
     - 
       id: "ID4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/ID4"
       desc: "An attacker can read content because messages (say, an email or HTTP cookie) aren't encrypted even if the channel is encrypted"
     - 
       id: "ID5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/ID5"
       desc: "An attacker may be able to read a document or data because it's encrypted with a non-standard algorithm"
     - 
       id: "ID6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/ID6"
       desc: "An attacker can read data because it's hidden or occluded (for undo or change tracking) and the user might forget that it's there"
     - 
       id: "ID7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/ID7"
       desc: "An attacker can act as a 'man in the middle' because you don't authenticate endpoints of a network connection"
     - 
       id: "ID8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/ID8"
       desc: "An attacker can access information through a search indexer, logger, or other such mechanism"
     - 
       id: "ID9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/ID9"
       desc: "An attacker can read sensitive information in a file with permissive permissions"
     - 
       id: "IDX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/IDX"
       desc: "An attacker can read information in files or databases with no access controls"
     - 
       id: "IDJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/IDJ"
       desc: "An attacker can discover the fixed key being used to encrypt"
     - 
       id: "IDQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/IDQ"
       desc: "An attacker can read the entire channel because the channel (say, HTTP or SMTP) isn't encrypted"
     - 
       id: "IDK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/IDK"
       desc: "An attacker can read network information because there's no cryptography used"
     - 
       id: "IDA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/IDA"
       desc: "You've invented a new Information Disclosure attack"
       misc: "Read more about this topic ..."
 -
@@ -240,62 +292,75 @@ suits:
     - 
       id: "DS2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/DS2"
       desc: "An attacker can make your authentication system unusable or unavailable"
     - 
       id: "DS3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/DS3"
       desc: "An attacker can drain our easily replacable battery "
       misc: "(battery, temporary)"
     - 
       id: "DS4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/DS4"
       desc: "An attacker can drain a battery that's hard to replace (sealed in a phone, an implanted medical device, or in a hard to reach location) "
       misc: "(battery, persist)"
     - 
       id: "DS5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/DS5"
       desc: "An attacker can spend our cloud budget "
       misc: "(budget, persist)"
     - 
       id: "DS6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/DS6"
       desc: "An attacker can make a server unavailable or unusable without ever authenticating but the problem goes away when the attacker stops "
       misc: "(server, anonymous, temporary)"
     - 
       id: "DS7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/DS7"
       desc: "An attacker can make a client unavailable or unusable and the problem persists after the attacker goes away "
       misc: "(client, auth, persist)"
     - 
       id: "DS8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/DS8"
       desc: "An attacker can make a server unavailable or unusable and the problem persists after the attacker goes away "
       misc: "(server, auth, persist)"
     - 
       id: "DS9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/DS9"
       desc: "An attacker can make a client unavailable or unusable without ever authenticating and the problem persists after the attacker goes away "
       misc: "(client, anon, persist)"
     - 
       id: "DSX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/DSX"
       desc: "An attacker can make a server unavailable or unusable without ever authenticating and the problem persists after the attacker goes away "
       misc: "(server, anonymous, persistent)"
     - 
       id: "DSJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/DSJ"
       desc: "An attacker can cause the logging subsystem to stop working"
     - 
       id: "DSQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/DSQ"
       desc: "An attacker can amplify a Denial of Service attack through this component with amplification on the order of 10 to 1"
     - 
       id: "DSK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/DSK"
       desc: "An attacker can amplify a Denial of Service attack through this component with amplification on the order of 100 to 1"
     - 
       id: "DSA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/DSA"
       desc: "You've invented a new Denial of Service attack"
       misc: "Read more about this topic ..."
 -
@@ -305,54 +370,67 @@ suits:
     - 
       id: "EP2"
       value: "2"
+      url: "https://cornucopia.owasp.org/cards/EP2"
       desc: "An attacker has compromised a key technology supplier"
     - 
       id: "EP3"
       value: "3"
+      url: "https://cornucopia.owasp.org/cards/EP3"
       desc: "An attacker can access the cloud service which manages your devices"
     - 
       id: "EP4"
       value: "4"
+      url: "https://cornucopia.owasp.org/cards/EP4"
       desc: "An attacker can escape from a container or other sandbox"
     - 
       id: "EP5"
       value: "5"
+      url: "https://cornucopia.owasp.org/cards/EP5"
       desc: "An attacker can force data through different validation paths which give different results"
     - 
       id: "EP6"
       value: "6"
+      url: "https://cornucopia.owasp.org/cards/EP6"
       desc: "An attacker could take advantage of permissions you set, but don't use"
     - 
       id: "EP7"
       value: "7"
+      url: "https://cornucopia.owasp.org/cards/EP7"
       desc: "An attacker can provide a pointer across a trust boundary, rather than data which can be validated"
     - 
       id: "EP8"
       value: "8"
+      url: "https://cornucopia.owasp.org/cards/EP8"
       desc: "An attacker can enter data that is checked while still under their control and used later on the other side of a trust boundary"
     - 
       id: "EP9"
       value: "9"
+      url: "https://cornucopia.owasp.org/cards/EP9"
       desc: "There's no reasonable way for a caller to figure out what validation of tainted data you perform before passing it to them"
     - 
       id: "EPX"
       value: "X"
+      url: "https://cornucopia.owasp.org/cards/EPX"
       desc: "There's no reasonable way for a caller to figure out what security assumptions you make"
     - 
       id: "EPJ"
       value: "J"
+      url: "https://cornucopia.owasp.org/cards/EPJ"
       desc: "An attacker can reflect input back to a user, like cross site scripting"
     - 
       id: "EPQ"
       value: "Q"
+      url: "https://cornucopia.owasp.org/cards/EPQ"
       desc: "You include user-generated content within your page, possibly including the content of random URLs"
     - 
       id: "EPK"
       value: "K"
+      url: "https://cornucopia.owasp.org/cards/EPK"
       desc: "An attacker can inject a command that the system will run at a higher privilege level"
     - 
       id: "EPA"
       value: "A"
+      url: "https://cornucopia.owasp.org/cards/EPA"
       desc: "You've invented a new Elevation of Privilege attack"
       misc: "Read more about this topic ..."
 paragraphs:
diff --git a/copi.owasp.org/priv/repo/migrations/20260711100557_populate_eop_card_urls.exs b/copi.owasp.org/priv/repo/migrations/20260711100557_populate_eop_card_urls.exs
new file mode 100644
index 000000000..4f69e3fc8
--- /dev/null
+++ b/copi.owasp.org/priv/repo/migrations/20260711100557_populate_eop_card_urls.exs
@@ -0,0 +1,11 @@
+defmodule Copi.Repo.Migrations.PopulateEopCardUrls do
+  use Ecto.Migration
+
+  import Copi.CardMigration
+
+
+  def change do
+    update_card_urls(Path.join(:code.priv_dir(:copi), "/repo/cornucopia/eop-cards-5.0-en.yaml"))
+    update_card_urls(Path.join(:code.priv_dir(:copi), "/repo/cornucopia/eop-cards-5.1-en.yaml"))
+  end
+end
diff --git a/cornucopia.owasp.org/data/website/phrases/en/cards.json b/cornucopia.owasp.org/data/website/phrases/en/cards.json
index 76da6cdf7..a57289308 100644
--- a/cornucopia.owasp.org/data/website/phrases/en/cards.json
+++ b/cornucopia.owasp.org/data/website/phrases/en/cards.json
@@ -10,16 +10,19 @@
     "button": {
       "1": "Website App version",
       "2": "Mobile App version",
-      "3": "Companion version"
+      "3": "Companion version",
+      "4": "Elevation of Privilege version"
     },
     "h2": {
       "1": "Website App version",
       "2": "Mobile App version",
-      "3": "Companion version"
+      "3": "Companion version",
+      "4": "Elevation of Privilege version"
     },
     "p2": "For the previously called Ecommerce Website Edition. Instead of EoP’s STRIDE suits, the suits were selected based on the structure of the OWASP Secure Coding Practices - Quick Reference Guide (SCP) which have been migrated to the OWASP Developer Guide Web Application Checklist. The content was mainly drawn from the SCP but with additional consideration of sections in the <a rel=\"noopener\" href=\"https://owasp.org/www-project-application-security-verification-standard/\">OWASP Application Security Verification Standard</a>, the <a rel=\"noopener\" href=\"https://owasp.org/www-project-web-security-testing-guide\">OWASP Web Security Testing Guide</a> and David Rook's <a rel=\"noopener\" href=\"/share/OWASP-SecureDevPrinciples-David-Rook.pdf\">Principles of Secure Development</a>. These provided five suits, and a sixth called “Cornucopia” was created for everything else:",
     "p3": "The second Cornucopia deck, the “Mobile App Edition”, follows the same principles and game rules as the original OWASP Cornucopia, but has different suits based on the <a rel=\"noopener\" href=\"https://mas.owasp.org/MASVS/\">MASVS categories</a>, in addition to the Cornucopia suit that contains threats related to mobile malware and privacy issues:",
     "p4": "The third Cornucopia deck, the “Companion Edition”, is a companion to the other two decks:",
+    "p5": "The fourth Cornucopia deck, the “Elevation of Privilege Edition” (EoP), is a threat modeling game developed by Microsoft. Instead of the security concepts featured in the first editions, EoP card suits are structured around the STRIDE threat categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege):",
     "card": {
       "p1": "Back to overview"
     },
@@ -55,6 +58,12 @@
         "2": "Attacks"
       }
     },
+    "eopCardTaxonomy": {
+      "h1": {
+        "1": "Mappings",
+        "2": "Attacks"
+      }
+    },
     "MASVSOverview": {
       "p1": "No suitable mappings were found."
     },
diff --git a/cornucopia.owasp.org/src/domain/card/order.ts b/cornucopia.owasp.org/src/domain/card/order.ts
index 6e33a81eb..942d80f9a 100644
--- a/cornucopia.owasp.org/src/domain/card/order.ts
+++ b/cornucopia.owasp.org/src/domain/card/order.ts
@@ -247,6 +247,84 @@ export const cardOrder = new Map<string,number>([
     ["BOTJ", 10],
     ["BOTQ", 11],
     ["BOTK", 12],
+    ["SPA", 0],
+    ["SP2", 1],
+    ["SP3", 2],
+    ["SP4", 3],
+    ["SP5", 4],
+    ["SP6", 5],
+    ["SP7", 6],
+    ["SP8", 7],
+    ["SP9", 8],
+    ["SPX", 9],
+    ["SPJ", 10],
+    ["SPQ", 11],
+    ["SPK", 12],
+    ["TAA", 0],
+    ["TA2", 1],
+    ["TA3", 2],
+    ["TA4", 3],
+    ["TA5", 4],
+    ["TA6", 5],
+    ["TA7", 6],
+    ["TA8", 7],
+    ["TA9", 8],
+    ["TAX", 9],
+    ["TAJ", 10],
+    ["TAQ", 11],
+    ["TAK", 12],
+    ["REA", 0],
+    ["RE2", 1],
+    ["RE3", 2],
+    ["RE4", 3],
+    ["RE5", 4],
+    ["RE6", 5],
+    ["RE7", 6],
+    ["RE8", 7],
+    ["RE9", 8],
+    ["REX", 9],
+    ["REJ", 10],
+    ["REQ", 11],
+    ["REK", 12],
+    ["IDA", 0],
+    ["ID2", 1],
+    ["ID3", 2],
+    ["ID4", 3],
+    ["ID5", 4],
+    ["ID6", 5],
+    ["ID7", 6],
+    ["ID8", 7],
+    ["ID9", 8],
+    ["IDX", 9],
+    ["IDJ", 10],
+    ["IDQ", 11],
+    ["IDK", 12],
+    ["DSA", 0],
+    ["DS2", 1],
+    ["DS3", 2],
+    ["DS4", 3],
+    ["DS5", 4],
+    ["DS6", 5],
+    ["DS7", 6],
+    ["DS8", 7],
+    ["DS9", 8],
+    ["DSX", 9],
+    ["DSJ", 10],
+    ["DSQ", 11],
+    ["DSK", 12],
+    ["EPA", 0],
+    ["EP2", 1],
+    ["EP3", 2],
+    ["EP4", 3],
+    ["EP5", 4],
+    ["EP6", 5],
+    ["EP7", 6],
+    ["EP8", 7],
+    ["EP9", 8],
+    ["EPX", 9],
+    ["EPJ", 10],
+    ["EPQ", 11],
+    ["EPK", 12],
     // Special cards
     ["JOA", 13],
     ["JOB", 14],
diff --git a/cornucopia.owasp.org/src/domain/suit/order.ts b/cornucopia.owasp.org/src/domain/suit/order.ts
index adbe9e113..a18cca922 100644
--- a/cornucopia.owasp.org/src/domain/suit/order.ts
+++ b/cornucopia.owasp.org/src/domain/suit/order.ts
@@ -20,4 +20,11 @@ export const order = new Map<string,number>([
     ["devops", 17],
     ["social-engineering", 18],
     ["automated-threats", 19],
+    // EoP suits
+    ["spoofing", 20],
+    ["tampering", 21],
+    ["repudiation", 22],
+    ["information-disclosure", 23],
+    ["denial-of-service", 24],
+    ["elevation-of-privilege", 25],
 ]);
diff --git a/cornucopia.owasp.org/src/domain/suit/suitController.ts b/cornucopia.owasp.org/src/domain/suit/suitController.ts
index 8488ebf65..c8335b21b 100644
--- a/cornucopia.owasp.org/src/domain/suit/suitController.ts
+++ b/cornucopia.owasp.org/src/domain/suit/suitController.ts
@@ -5,11 +5,12 @@ import { cardOrder } from "$domain/card/order";
 
 export class SuitController {
 
-    private static readonly decks = [{edition: 'mobileapp', version: '1.1'}, {edition: 'webapp', version: '3.0'}, {edition: 'companion', version: '1.0'}];
+    private static readonly decks = [{edition: 'mobileapp', version: '1.1'}, {edition: 'webapp', version: '3.0'}, {edition: 'companion', version: '1.0'}, {edition: 'eop', version: '5.0'}];
     private static languages : Map<string, { lang: string[] }> = new Map<string, { lang: string[] }>([
         ['mobileapp', {lang: ['en']}], 
         ['webapp', {lang: ['en', 'es', 'fr', 'nl', 'no_nb', 'pt_br', 'pt_pt', 'ru', 'it']}],
-        ['companion', {lang: ['en']}]
+        ['companion', {lang: ['en']}],
+        ['eop', {lang: ['en']}]
     ]);
 
     public static getSuits() : Map<string,Suit[]>
diff --git a/cornucopia.owasp.org/src/lib/components/cardFound.svelte b/cornucopia.owasp.org/src/lib/components/cardFound.svelte
index 9b1ff7e98..eec3fd4f4 100644
--- a/cornucopia.owasp.org/src/lib/components/cardFound.svelte
+++ b/cornucopia.owasp.org/src/lib/components/cardFound.svelte
@@ -13,6 +13,15 @@
   import { readTranslation } from "$lib/stores/stores";
   import Concept from './concept.svelte';
   import CompanionCardTaxonomy from './companionCardTaxonomy.svelte';
+  import EopCardTaxonomy from './eopCardTaxonomy.svelte';
+  import type { Component } from "svelte";
+
+  const taxonomies: Record<string, Component<any>> = {
+    webapp: WebAppCardTaxonomy,
+    mobileapp: MobileAppCardTaxonomy,
+    companion: CompanionCardTaxonomy,
+    eop: EopCardTaxonomy
+  };
 
   interface Props {
     mappingData: any;
@@ -41,6 +50,7 @@
   let mappings = $derived(controller.getCardMappings(card.id));
   let _attacks: Attack[] = $derived(GetCardAttacks(card.id));
   const asvsVersion = $derived(card.version < '3.0' ? '4.0.3' : '5.0');
+  let Taxonomy = $derived(taxonomies[card.edition]);
 </script>
 <LanguagePicker 
   edition={card.edition}
@@ -74,14 +84,8 @@
   <a title="How to play OWASP Cornucopia" class="link" href="/how-to-play">{$t('cards.cardFound.a')}</a>
   <Concept card={card}></Concept>
   <Explanation card={card}></Explanation>
-  {#if card.edition == 'webapp'}
-  <WebAppCardTaxonomy {card} {mappingData} {routes} {capecData} {asvsVersion}></WebAppCardTaxonomy>
-  {/if}
-  {#if card.edition == 'mobileapp'}
-  <MobileAppCardTaxonomy {card} {mappingData} {routes}></MobileAppCardTaxonomy>
-  {/if}
-  {#if card.edition == "companion"}
-  <CompanionCardTaxonomy {card} {mappingData} {routes}></CompanionCardTaxonomy>
+  {#if Taxonomy}
+  <svelte:component this={Taxonomy} {card} {mappingData} {routes} {capecData} {asvsVersion} />
   {/if}
     {#key card}
         <ViewSourceOnGithub path={card.githubUrl}></ViewSourceOnGithub>
diff --git a/cornucopia.owasp.org/src/lib/components/cardPreview.svelte b/cornucopia.owasp.org/src/lib/components/cardPreview.svelte
index c5b3dc941..1705b5b25 100644
--- a/cornucopia.owasp.org/src/lib/components/cardPreview.svelte
+++ b/cornucopia.owasp.org/src/lib/components/cardPreview.svelte
@@ -1,9 +1,17 @@
 <script lang="ts">
+    import type { Component } from "svelte";
     import type { Card } from "../../domain/card/card";
     import { cardColor } from "../../domain/card/cardColor";
     import MobileAppCardMapping from "./mobileAppCardMapping.svelte";
     import CompanionCardMapping from "./companionCardMapping.svelte";
-    
+    import EopCardMapping from "./eopCardMapping.svelte";
+
+    const mappingComponents: Record<string, Component<any>> = {
+        mobileapp: MobileAppCardMapping,
+        companion: CompanionCardMapping,
+        eop: EopCardMapping
+    };
+
     interface Props {
         card?: Card;
         mapping: Record<string, unknown>;
@@ -12,6 +20,7 @@
 
     let { card = $bindable(), mapping, style = '' }: Props = $props();
     let previewStyle = $derived(style ? ' ' + style : '');
+    let MappingComponent = $derived(mappingComponents[card?.edition ?? '']);
 
     function getSuitColor(suit : string, id: string)
     {
@@ -46,8 +55,23 @@
         if (['J', 'Q', 'K'].includes(value)) return base + ' left-royal';
         return base;
     }
+
+    // handles the conversion of the value for the EoP cards between the copi and cornucopia codebases
+    function eopValue(value: string)
+    {
+        return value === 'X' ? '10' : value;
+    }
 </script>
 
+{#if card?.edition === 'eop'}
+<div class="card-render eop {card?.suit} n{eopValue(card?.value)}">
+    <div class="left-value">{eopValue(card?.value)}</div>
+    <div class="main-content">
+        <p class="category">{card?.suitName}</p>
+        <p class="description">{card?.desc}</p>
+    </div>
+</div>
+{:else}
 <div class="card-render">
     <div class="left {getLeftRibbonClass(card?.suit, card?.suitId, card?.value)}">
         <span class="property-card-suit{previewStyle}">{card?.suitName}</span>
@@ -57,11 +81,8 @@
         {#if mapping}
         <span class="property-card-number{previewStyle} {getTextColor(card?.suit, card?.suitId)}-text {getRoyalTextColor(card?.suit, card?.suitId, card?.value)}">{card?.card ?? card?.value}</span>
         <p class="property-card-description{previewStyle}">{card?.desc}</p>
-            {#if card?.edition == 'mobileapp'}
-                <MobileAppCardMapping {mapping}  {style}></MobileAppCardMapping>
-            {/if}
-            {#if card?.edition == 'companion'}
-                <CompanionCardMapping {mapping} {style}></CompanionCardMapping>
+            {#if MappingComponent}
+                <svelte:component this={MappingComponent} {mapping} {style} />
             {/if}
         {:else if card?.suitName == 'WILD CARD'}
         <span class="property-card-number {getSuitColor(card.suit, card?.suitId)}">Joker</span>
@@ -72,6 +93,7 @@
         {/if}
     </div>
 </div>
+{/if}
 
 <style>
     span
@@ -418,5 +440,460 @@
             font-size: 10vw;
         }
     }
+
+    /* EoP card styles imported from copi.owasp.org/assets/css/cards.scss (.card and .card.eop) */
+    .card-render.eop {
+      width: clamp(240px, 24vw, 320px);
+      height: clamp(351px, 35.1vw, 469px);
+      border-radius: clamp(12px, 1.5vw, 16px);
+    }
+
+    .card-render.eop .left-value {
+      box-sizing: border-box; /* fixes the double height issue of card number box */
+      flex: none;
+      position: relative;
+      top: clamp(36px, 3.6vw, 48px);
+      height: clamp(72px, 7.2vw, 96px);
+      width: clamp(55px, 5.5vw, 74px);
+      background: grey;
+      padding: clamp(28px, 2.8vw, 37px) 0;
+      border-top-right-radius: clamp(12px, 1.2vw, 16px);
+      border-bottom-right-radius: clamp(12px, 1.2vw, 16px);
+      color: #fff;
+      text-transform: uppercase;
+      font-family: "Segoe Condensed";
+      font-size: clamp(41px, 4.1vw, 55px);
+      font-weight: 600;
+      text-align: center;
+      line-height: clamp(14px, 1.4vw, 22px);
+    }
+
+    .card-render.eop .main-content {
+      overflow: hidden;
+      flex: auto;
+      padding: clamp(13px, 1.3vw, 18px) clamp(12px, 1.2vw, 16px);
+    }
+
+    .card-render.eop .main-content .category {
+      margin: clamp(38px, 3.8vw, 51px) 0 0 0;
+      font-family: "Segoe Light";
+      font-size: clamp(22px, 2.2vw, 29px);
+      font-weight: 300;
+    }
+
+    .card-render.eop .main-content .description {
+      font-family: "Segoe";
+      font-size: clamp(12px, 1.2vw, 16px);
+      padding-right: 0px;
+      line-height: 1.3;
+    }
+
+    .card-render.eop.spoofing .left-value {
+      background: rgb(117, 35, 26);
+    }
+
+    .card-render.eop.spoofing.nJ, .card-render.eop.spoofing.nQ, .card-render.eop.spoofing.nK {
+      background: rgb(178, 25, 74);
+    }
+
+    .card-render.eop.spoofing.nJ .main-content, .card-render.eop.spoofing.nQ .main-content, .card-render.eop.spoofing.nK .main-content {
+      color: #fff;
+    }
+
+    .card-render.eop.spoofing.n2 {
+      background: no-repeat top/100% url("/images/eop-cards/spoofing-2.png") #fff;
+    }
+
+    .card-render.eop.spoofing.n3 {
+      background: no-repeat top/100% url("/images/eop-cards/spoofing-3.png") #fff;
+    }
+
+    .card-render.eop.spoofing.n4 {
+      background: no-repeat bottom/100% url("/images/eop-cards/spoofing-4.png") #fff;
+    }
+
+    .card-render.eop.spoofing.n5 {
+      background: no-repeat top/100% url("/images/eop-cards/spoofing-5.png") #fff;
+    }
+
+    .card-render.eop.spoofing.n6 {
+      background: no-repeat bottom/100% url("/images/eop-cards/spoofing-6.png") #fff;
+    }
+
+    .card-render.eop.spoofing.n7 {
+      background: no-repeat center/100% url("/images/eop-cards/spoofing-7.png") #fff;
+    }
+
+    .card-render.eop.spoofing.n8 {
+      background: no-repeat top/100% url("/images/eop-cards/spoofing-8.png") #fff;
+    }
+
+    .card-render.eop.spoofing.n9 {
+      background: no-repeat center/100% url("/images/eop-cards/spoofing-9.png") #fff;
+    }
+
+    .card-render.eop.spoofing.n10 {
+      background: no-repeat top/100% url("/images/eop-cards/spoofing-10.png") #fff;
+    }
+
+    .card-render.eop.spoofing.nJ {
+      background: no-repeat center/100% url("/images/eop-cards/spoofing-j.png") #fff;
+    }
+
+    .card-render.eop.spoofing.nQ {
+      background: no-repeat center/100% url("/images/eop-cards/spoofing-q.png") #fff;
+    }
+
+    .card-render.eop.spoofing.nK {
+      background: no-repeat center/100% url("/images/eop-cards/spoofing-k.png") #fff;
+    }
+
+    .card-render.eop.spoofing.nA {
+      background: no-repeat bottom/100% url("/images/eop-cards/spoofing-a.png") #fff;
+    }
+
+    .card-render.eop.spoofing.nJ, .card-render.eop.spoofing.nQ, .card-render.eop.spoofing.nK, .card-render.eop.spoofing.nA, .card-render.eop.spoofing.n2, .card-render.eop.spoofing.n3, .card-render.eop.spoofing.n4, .card-render.eop.spoofing.n5, .card-render.eop.spoofing.n6, .card-render.eop.spoofing.n7, .card-render.eop.spoofing.n8, .card-render.eop.spoofing.n9, .card-render.eop.spoofing.n10 {
+      background-size: cover;
+    }
+
+    .card-render.eop.tampering .left-value {
+      background: rgb(2, 113, 55);
+    }
+
+    .card-render.eop.tampering.nJ, .card-render.eop.tampering.nQ, .card-render.eop.tampering.nK {
+      background: rgb(116, 187, 99);
+    }
+
+    .card-render.eop.tampering.nJ .main-content, .card-render.eop.tampering.nQ .main-content, .card-render.eop.tampering.nK .main-content {
+      color: #fff;
+    }
+
+    .card-render.eop.tampering.n2 {
+      background: no-repeat top/100% url("/images/eop-cards/tampering-2.png") #fff;
+    }
+
+    .card-render.eop.tampering.n3 {
+      background: no-repeat top/100% url("/images/eop-cards/tampering-3.png") #fff;
+    }
+
+    .card-render.eop.tampering.n4 {
+      background: no-repeat bottom/100% url("/images/eop-cards/tampering-4.png") #fff;
+    }
+
+    .card-render.eop.tampering.n5 {
+      background: no-repeat top/100% url("/images/eop-cards/tampering-5.png") #fff;
+    }
+
+    .card-render.eop.tampering.n6 {
+      background: no-repeat bottom/100% url("/images/eop-cards/tampering-6.png") #fff;
+    }
+
+    .card-render.eop.tampering.n7 {
+      background: no-repeat center/100% url("/images/eop-cards/tampering-7.png") #fff;
+    }
+
+    .card-render.eop.tampering.n8 {
+      background: no-repeat top/100% url("/images/eop-cards/tampering-8.png") #fff;
+    }
+
+    .card-render.eop.tampering.n9 {
+      background: no-repeat center/100% url("/images/eop-cards/tampering-9.png") #fff;
+    }
+
+    .card-render.eop.tampering.n10 {
+      background: no-repeat top/100% url("/images/eop-cards/tampering-10.png") #fff;
+    }
+
+    .card-render.eop.tampering.nJ {
+      background: no-repeat top/100% url("/images/eop-cards/tampering-j.png") #fff;
+    }
+
+    .card-render.eop.tampering.nQ {
+      background: no-repeat top/100% url("/images/eop-cards/tampering-q.png") #fff;
+    }
+
+    .card-render.eop.tampering.nK {
+      background: no-repeat center/100% url("/images/eop-cards/tampering-k.png") #fff;
+    }
+
+    .card-render.eop.tampering.nA {
+      background: no-repeat bottom/100% url("/images/eop-cards/tampering-a.png") #fff;
+    }
+
+    .card-render.eop.tampering.nJ, .card-render.eop.tampering.nQ, .card-render.eop.tampering.nK, .card-render.eop.tampering.nA, .card-render.eop.tampering.n2, .card-render.eop.tampering.n3, .card-render.eop.tampering.n4, .card-render.eop.tampering.n5, .card-render.eop.tampering.n6, .card-render.eop.tampering.n7, .card-render.eop.tampering.n8, .card-render.eop.tampering.n9, .card-render.eop.tampering.n10 {
+      background-size: cover;
+    }
+
+    .card-render.eop.repudiation .left-value {
+      background: rgb(117, 35, 26);
+    }
+
+    .card-render.eop.repudiation.nJ, .card-render.eop.repudiation.nQ, .card-render.eop.repudiation.nK {
+      background: rgb(229, 114, 63);
+    }
+
+    .card-render.eop.repudiation.nJ .main-content, .card-render.eop.repudiation.nQ .main-content, .card-render.eop.repudiation.nK .main-content {
+      color: #fff;
+    }
+
+    .card-render.eop.repudiation.n2 {
+      background: no-repeat top/100% url("/images/eop-cards/repudiation-2.png") #fff;
+    }
+
+    .card-render.eop.repudiation.n3 {
+      background: no-repeat top/100% url("/images/eop-cards/repudiation-3.png") #fff;
+    }
+
+    .card-render.eop.repudiation.n4 {
+      background: no-repeat bottom/100% url("/images/eop-cards/repudiation-4.png") #fff;
+    }
+
+    .card-render.eop.repudiation.n5 {
+      background: no-repeat top/100% url("/images/eop-cards/repudiation-5.png") #fff;
+    }
+
+    .card-render.eop.repudiation.n6 {
+      background: no-repeat bottom/100% url("/images/eop-cards/repudiation-6.png") #fff;
+    }
+
+    .card-render.eop.repudiation.n7 {
+      background: no-repeat center/100% url("/images/eop-cards/repudiation-7.png") #fff;
+    }
+
+    .card-render.eop.repudiation.n8 {
+      background: no-repeat top/100% url("/images/eop-cards/repudiation-8.png") #fff;
+    }
+
+    .card-render.eop.repudiation.n9 {
+      background: no-repeat center/100% url("/images/eop-cards/repudiation-9.png") #fff;
+    }
+
+    .card-render.eop.repudiation.n10 {
+      background: no-repeat top/100% url("/images/eop-cards/repudiation-10.png") #fff;
+    }
+
+    .card-render.eop.repudiation.nJ {
+      background: no-repeat center/100% url("/images/eop-cards/repudiation-j.png") #fff;
+    }
+
+    .card-render.eop.repudiation.nQ {
+      background: no-repeat center/100% url("/images/eop-cards/repudiation-q.png") #fff;
+    }
+
+    .card-render.eop.repudiation.nK {
+      background: no-repeat bottom/100% url("/images/eop-cards/repudiation-k.png") #fff;
+    }
+
+    .card-render.eop.repudiation.nA {
+      background: no-repeat bottom/100% url("/images/eop-cards/repudiation-a.png") #fff;
+    }
+
+    .card-render.eop.repudiation.nJ, .card-render.eop.repudiation.nQ, .card-render.eop.repudiation.nK, .card-render.eop.repudiation.nA, .card-render.eop.repudiation.n2, .card-render.eop.repudiation.n3, .card-render.eop.repudiation.n4, .card-render.eop.repudiation.n5, .card-render.eop.repudiation.n6, .card-render.eop.repudiation.n7, .card-render.eop.repudiation.n8, .card-render.eop.repudiation.n9, .card-render.eop.repudiation.n10 {
+      background-size: cover;
+    }
+
+    .card-render.eop.information-disclosure .left-value {
+      background: rgb(255, 240, 39);
+    }
+
+    .card-render.eop.information-disclosure.nJ, .card-render.eop.information-disclosure.nQ, .card-render.eop.information-disclosure.nK {
+      background: rgb(0, 159, 156);
+    }
+
+    .card-render.eop.information-disclosure.nJ .main-content, .card-render.eop.information-disclosure.nQ .main-content, .card-render.eop.information-disclosure.nK .main-content {
+      color: #fff;
+    }
+
+    .card-render.eop.information-disclosure.n2 {
+      background: no-repeat top/100% url("/images/eop-cards/information-disclosure-2.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.n3 {
+      background: no-repeat top/100% url("/images/eop-cards/information-disclosure-3.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.n4 {
+      background: no-repeat bottom/100% url("/images/eop-cards/information-disclosure-4.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.n5 {
+      background: no-repeat top/100% url("/images/eop-cards/information-disclosure-5.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.n6 {
+      background: no-repeat bottom/100% url("/images/eop-cards/information-disclosure-6.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.n7 {
+      background: no-repeat top/100% url("/images/eop-cards/information-disclosure-7.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.n8 {
+      background: no-repeat top 15px left/100% url("/images/eop-cards/information-disclosure-8.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.n9 {
+      background: no-repeat center/100% url("/images/eop-cards/information-disclosure-9.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.n10 {
+      background: no-repeat top 28px left/100% url("/images/eop-cards/information-disclosure-10.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.nJ {
+      background: no-repeat center/100% url("/images/eop-cards/information-disclosure-j.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.nQ {
+      background: no-repeat top left/100% url("/images/eop-cards/information-disclosure-q.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.nK {
+      background: no-repeat top 9px left/100% url("/images/eop-cards/information-disclosure-k.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.nA {
+      background: no-repeat bottom/100% url("/images/eop-cards/information-disclosure-a.png") #fff;
+    }
+
+    .card-render.eop.information-disclosure.nJ, .card-render.eop.information-disclosure.nQ, .card-render.eop.information-disclosure.nK, .card-render.eop.information-disclosure.nA, .card-render.eop.information-disclosure.n2, .card-render.eop.information-disclosure.n3, .card-render.eop.information-disclosure.n4, .card-render.eop.information-disclosure.n5, .card-render.eop.information-disclosure.n6, .card-render.eop.information-disclosure.n7, .card-render.eop.information-disclosure.n8, .card-render.eop.information-disclosure.n9, .card-render.eop.information-disclosure.n10 {
+      background-size: cover;
+    }
+
+    .card-render.eop.denial-of-service .left-value {
+      background: rgb(26, 25, 25);
+    }
+
+    .card-render.eop.denial-of-service.nJ, .card-render.eop.denial-of-service.nQ, .card-render.eop.denial-of-service.nK {
+      background: rgb(102, 102, 101);
+    }
+
+    .card-render.eop.denial-of-service.nJ .main-content, .card-render.eop.denial-of-service.nQ .main-content, .card-render.eop.denial-of-service.nK .main-content {
+      color: #fff;
+    }
+
+    .card-render.eop.denial-of-service.n2 {
+      background: no-repeat top/100% url("/images/eop-cards/denial-of-service-2.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.n3 {
+      background: no-repeat top/100% url("/images/eop-cards/denial-of-service-3.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.n4 {
+      background: no-repeat bottom/100% url("/images/eop-cards/denial-of-service-4.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.n5 {
+      background: no-repeat top/100% url("/images/eop-cards/denial-of-service-5.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.n6 {
+      background: no-repeat bottom/100% url("/images/eop-cards/denial-of-service-6.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.n7 {
+      background: no-repeat center/100% url("/images/eop-cards/denial-of-service-7.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.n8 {
+      background: no-repeat top/100% url("/images/eop-cards/denial-of-service-8.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.n9 {
+      background: no-repeat top -15px left/100% url("/images/eop-cards/denial-of-service-9.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.n10 {
+      background: no-repeat top 2px left/100% url("/images/eop-cards/denial-of-service-10.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.nJ {
+      background: no-repeat center/100% url("/images/eop-cards/denial-of-service-j.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.nQ {
+      background: no-repeat top -10px left/100% url("/images/eop-cards/denial-of-service-q.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.nK {
+      background: no-repeat top/100% url("/images/eop-cards/denial-of-service-k.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.nA {
+      background: no-repeat bottom/100% url("/images/eop-cards/denial-of-service-a.png") #fff;
+    }
+
+    .card-render.eop.denial-of-service.nJ, .card-render.eop.denial-of-service.nQ, .card-render.eop.denial-of-service.nK, .card-render.eop.denial-of-service.nA, .card-render.eop.denial-of-service.n2, .card-render.eop.denial-of-service.n3, .card-render.eop.denial-of-service.n4, .card-render.eop.denial-of-service.n5, .card-render.eop.denial-of-service.n6, .card-render.eop.denial-of-service.n7, .card-render.eop.denial-of-service.n8, .card-render.eop.denial-of-service.n9, .card-render.eop.denial-of-service.n10 {
+      background-size: cover;
+    }
+
+    .card-render.eop.elevation-of-privilege .left-value {
+      background: rgb(229, 114, 63);
+    }
+
+    .card-render.eop.elevation-of-privilege.nJ, .card-render.eop.elevation-of-privilege.nQ, .card-render.eop.elevation-of-privilege.nK {
+      background: rgb(69, 139, 189);
+    }
+
+    .card-render.eop.elevation-of-privilege.nJ .main-content, .card-render.eop.elevation-of-privilege.nQ .main-content, .card-render.eop.elevation-of-privilege.nK .main-content {
+      color: #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.n2 {
+      background: no-repeat top/100% url("/images/eop-cards/elevation-of-privilege-2.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.n3 {
+      background: no-repeat top/100% url("/images/eop-cards/elevation-of-privilege-3.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.n4 {
+      background: no-repeat top/100% url("/images/eop-cards/elevation-of-privilege-4.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.n5 {
+      background: no-repeat top/100% url("/images/eop-cards/elevation-of-privilege-5.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.n6 {
+      background: no-repeat bottom/100% url("/images/eop-cards/elevation-of-privilege-6.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.n7 {
+      background: no-repeat center/100% url("/images/eop-cards/elevation-of-privilege-7.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.n8 {
+      background: no-repeat top 15px left/100% url("/images/eop-cards/elevation-of-privilege-8.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.n9 {
+      background: no-repeat top/100% url("/images/eop-cards/elevation-of-privilege-9.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.n10 {
+      background: no-repeat top 30px left/100% url("/images/eop-cards/elevation-of-privilege-10.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.nJ {
+      background: no-repeat center/100% url("/images/eop-cards/elevation-of-privilege-j.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.nQ {
+      background: no-repeat top -9px left/100% url("/images/eop-cards/elevation-of-privilege-q.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.nK {
+      background: no-repeat top/100% url("/images/eop-cards/elevation-of-privilege-k.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.nA {
+      background: no-repeat bottom/100% url("/images/eop-cards/elevation-of-privilege-a.png") #fff;
+    }
+
+    .card-render.eop.elevation-of-privilege.nJ, .card-render.eop.elevation-of-privilege.nQ, .card-render.eop.elevation-of-privilege.nK, .card-render.eop.elevation-of-privilege.nA, .card-render.eop.elevation-of-privilege.n2, .card-render.eop.elevation-of-privilege.n3, .card-render.eop.elevation-of-privilege.n4, .card-render.eop.elevation-of-privilege.n5, .card-render.eop.elevation-of-privilege.n6, .card-render.eop.elevation-of-privilege.n7, .card-render.eop.elevation-of-privilege.n8, .card-render.eop.elevation-of-privilege.n9, .card-render.eop.elevation-of-privilege.n10 {
+      background-size: cover;
+    }
 </style>
 
diff --git a/cornucopia.owasp.org/src/lib/components/eopCardMapping.svelte b/cornucopia.owasp.org/src/lib/components/eopCardMapping.svelte
new file mode 100644
index 000000000..e66defea3
--- /dev/null
+++ b/cornucopia.owasp.org/src/lib/components/eopCardMapping.svelte
@@ -0,0 +1,57 @@
+<script lang="ts">
+    interface Props {
+        mapping: Record<string, unknown>;
+        style?: string;
+    }
+
+    let { mapping, style = '' }: Props = $props();
+    let mappingStyle = $derived(style ? ' ' + style : '');
+
+    let stride = $derived(String(mapping?.stride ?? '') || '-');
+</script>
+
+<p class="mapping-title{mappingStyle}">STRIDE</p>
+<p class="mapping-value{mappingStyle}">{stride}</p>
+
+<style>
+    .mapping-title, .mapping-value {
+        font-size: 1.1vw;
+        margin: 0;
+        margin-left: .25rem;
+        margin-right: .25rem;
+        word-wrap: break-word;
+        white-space: initial;
+    }
+
+    .hero-card-container {
+        font-size: max(0.3vh, 0.6vw);
+    }
+
+    .mapping-title {
+        font-weight: bold;
+    }
+
+    .mapping-value {
+        border-bottom: 1px rgb(192, 192, 192) solid;
+    }
+
+    .mapping-title.browser-card-container,
+    .mapping-value.browser-card-container {
+        font-size: 0.7vw;
+        margin-left: 1vw;
+        margin-right: 1vw;
+    }
+
+    @media (max-width: 1024px) {
+        .mapping-title.browser-card-container,
+        .mapping-value.browser-card-container {
+            font-size: 2vw;
+            margin-left: 1vw;
+            margin-right: 1vw;
+        }
+
+        .mapping-title.browser-card-container:first-of-type {
+            margin-top: 2vw;
+        }
+    }
+</style>
diff --git a/cornucopia.owasp.org/src/lib/components/eopCardTaxonomy.svelte b/cornucopia.owasp.org/src/lib/components/eopCardTaxonomy.svelte
new file mode 100644
index 000000000..0632890fa
--- /dev/null
+++ b/cornucopia.owasp.org/src/lib/components/eopCardTaxonomy.svelte
@@ -0,0 +1,47 @@
+<script lang="ts">
+    import { GetCardAttacks, type Attack } from "$lib/cardAttacks";
+    import type { Card } from "../../domain/card/card";
+    import type { Route } from "../../domain/routes/route";
+    import { MappingController } from "../../domain/mapping/mappingController";
+    import MappingsList from "$lib/components/mappingsList.svelte";
+    import Attacks from "./attacks.svelte";
+    import { readTranslation } from "$lib/stores/stores";
+
+    interface Props {
+        mappingData: Record<string, unknown>;
+        card: Card;
+        routes: Map<string, Route[]>;
+    }
+
+    let { mappingData, card = $bindable(), routes: _routes }: Props = $props();
+
+    const controller = $derived(new MappingController(mappingData));
+    let t = readTranslation();
+
+    let mappings: Record<string, unknown> = $derived(controller.getCardMappings(card?.id));
+    let attacks: Attack[] = $derived(GetCardAttacks(card?.id) as Attack[]);
+
+    function formatValue(val: unknown): string[] {
+        if (val === undefined || val === null) return ["-"];
+        if (Array.isArray(val))
+            return val.length ? val.map((v) => String(v)) : ["-"];
+        return [String(val)];
+    }
+</script>
+
+{#if mappings}
+    <h2 id="mapping" class="title">{$t("cards.eopCardTaxonomy.h1.1")}</h2>
+    <MappingsList title="STRIDE:" mappings={formatValue(mappings['stride'])} />
+    <h2 class="title">{$t("cards.eopCardTaxonomy.h1.2")}</h2>
+    {#if attacks}
+        <Attacks {attacks} />
+    {/if}
+{/if}
+
+<style>
+    .title {
+        background: var(--background);
+        color: white;
+        padding: 0.5rem;
+    }
+</style>
diff --git a/cornucopia.owasp.org/src/lib/services/decService.integration.test.ts b/cornucopia.owasp.org/src/lib/services/decService.integration.test.ts
index 714a56475..095a497cb 100644
--- a/cornucopia.owasp.org/src/lib/services/decService.integration.test.ts
+++ b/cornucopia.owasp.org/src/lib/services/decService.integration.test.ts
@@ -39,6 +39,8 @@ describe('DeckService integration tests', () => {
 
         expect((new DeckService()).getCardDataForEditionVersionLang('mobileapp', '1.1', 'en')).toBeDefined();
         expect((new DeckService()).getCardDataForEditionVersionLang('companion', '1.0', 'en')).toBeDefined();
+        expect((new DeckService()).getCardDataForEditionVersionLang('eop', '5.0', 'en')).toBeDefined();
+        expect((new DeckService()).getCardDataForEditionVersionLang('eop', '5.0', 'en').size).toBe(78);
 
         expect((new DeckService()).getCardDataForEditionVersionLang('webapp', '2.2', 'en').size).toBe(80);
         expect((new DeckService()).getCardDataForEditionVersionLang('webapp', '3.0', 'ru').size).toBe(80);
@@ -53,8 +55,8 @@ describe('DeckService integration tests', () => {
         expect((new DeckService()).getCardDataForEditionVersionLang('webapp', '2.2', 'pt_pt').size).toBe(80);
     }, 30000);
 
-    it("should return 238 cards.", async () => {
+    it("should return 316 cards.", async () => {
         const cards = (new DeckService()).getCards('en');
-        expect(cards.size).toBe(238);
+        expect(cards.size).toBe(316);
     });
 });
diff --git a/cornucopia.owasp.org/src/lib/services/deckService.test.ts b/cornucopia.owasp.org/src/lib/services/deckService.test.ts
index b6466098d..9c8c6c2ed 100644
--- a/cornucopia.owasp.org/src/lib/services/deckService.test.ts
+++ b/cornucopia.owasp.org/src/lib/services/deckService.test.ts
@@ -33,6 +33,10 @@ describe('DeckService tests', () => {
             expect(DeckService.hasEdition('companion')).toBe(true);
         });
 
+        it('should return true for eop edition', () => {
+            expect(DeckService.hasEdition('eop')).toBe(true);
+        });
+
         it('should return false for unknown edition', () => {
             expect(DeckService.hasEdition('unknown')).toBe(false);
         });
@@ -59,6 +63,10 @@ describe('DeckService tests', () => {
             expect(DeckService.hasVersion('companion', '1.0')).toBe(true);
         });
 
+        it('should return true for eop version 5.0', () => {
+            expect(DeckService.hasVersion('eop', '5.0')).toBe(true);
+        });
+
         it('should return false for invalid version', () => {
             expect(DeckService.hasVersion('webapp', '1.0')).toBe(false);
         });
@@ -113,6 +121,10 @@ describe('DeckService tests', () => {
             expect(DeckService.hasLanguage('companion', 'en')).toBe(true);
         });
 
+        it('should return true for eop with en', () => {
+            expect(DeckService.hasLanguage('eop', 'en')).toBe(true);
+        });
+
         it('should return false for mobileapp with es', () => {
             expect(DeckService.hasLanguage('mobileapp', 'es')).toBe(false);
         });
@@ -129,9 +141,10 @@ describe('DeckService tests', () => {
     describe('getDecks', () => {
         it('should return all available decks', () => {
             const decks = DeckService.getDecks();
-            expect(decks).toHaveLength(5);
+            expect(decks).toHaveLength(6);
             expect(decks).toContainEqual({ edition: 'mobileapp', version: '1.1', lang: ['en', 'hi', 'uk'] });
             expect(decks).toContainEqual({ edition: 'companion', version: '1.0', lang: ['en'] });
+            expect(decks).toContainEqual({ edition: 'eop', version: '5.0', lang: ['en'] });
             expect(decks).toContainEqual({ edition: 'dbd', version: '1.0', lang: ['en'] });
             expect(decks).toContainEqual({ 
                 edition: 'webapp', 
@@ -155,6 +168,10 @@ describe('DeckService tests', () => {
             expect(DeckService.getLatestVersion('companion')).toBe('1.0');
         });
 
+        it('should return 5.0 for eop', () => {
+            expect(DeckService.getLatestVersion('eop')).toBe('5.0');
+        });
+
         it('should return 3.0 as default for unknown edition', () => {
             expect(DeckService.getLatestVersion('unknown')).toBe('3.0');
         });
@@ -163,10 +180,11 @@ describe('DeckService tests', () => {
     describe('getLatestEditions', () => {
         it('should return array of latest editions', () => {
             const editions = DeckService.getLatestEditions();
-            expect(editions).toHaveLength(3);
+            expect(editions).toHaveLength(4);
             expect(editions).toContain('webapp');
             expect(editions).toContain('mobileapp');
             expect(editions).toContain('companion');
+            expect(editions).toContain('eop');
         });
     }, 10000);
 
@@ -194,6 +212,11 @@ describe('DeckService tests', () => {
             expect(languages).toContain('en');
         });
 
+        it('should return en for eop', () => {
+            const languages = DeckService.getLanguages('eop');
+            expect(languages).toContain('en');
+        });
+
         it('should return en for dbd', () => {
             const languages = DeckService.getLanguages('dbd');
             expect(languages).toContain('en');
@@ -225,6 +248,11 @@ describe('DeckService tests', () => {
             expect(languages).toEqual(['en']);
         });
 
+        it('should return only en for eop version 5.0', () => {
+            const languages = DeckService.getLanguagesForEditionVersion('eop', '5.0');
+            expect(languages).toEqual(['en']);
+        });
+
         it('should return empty array for unknown version', () => {
             const languages = DeckService.getLanguagesForEditionVersion('webapp', '1.0');
             expect(languages).toEqual([]);
@@ -254,6 +282,11 @@ describe('DeckService tests', () => {
             expect(versions).toEqual(['1.0']);
             });
 
+        it('should return version for eop', () => {
+            const versions = DeckService.getVersions('eop');
+            expect(versions).toEqual(['5.0']);
+        });
+
         it('should return empty array for unknown edition', () => {
             const versions = DeckService.getVersions('unknown');
             expect(versions).toEqual([]);
diff --git a/cornucopia.owasp.org/src/lib/services/deckService.ts b/cornucopia.owasp.org/src/lib/services/deckService.ts
index 4f43721a6..059bb9c2d 100644
--- a/cornucopia.owasp.org/src/lib/services/deckService.ts
+++ b/cornucopia.owasp.org/src/lib/services/deckService.ts
@@ -16,13 +16,15 @@ export class DeckService {
     private static readonly latests: Deck[] = [
         { lang: ['en', 'hi', 'uk'], edition: 'mobileapp', version: '1.1' },
         { lang: ['en', 'es', 'fr', 'nl', 'no_nb', 'pt_br', 'pt_pt', 'ru', 'it', 'hi', 'uk'], edition: 'webapp', version: '3.0' },
-        { lang: ['en'], edition: 'companion', version: '1.0' }
+        { lang: ['en'], edition: 'companion', version: '1.0' },
+        { lang: ['en'], edition: 'eop', version: '5.0' }
     ];
     private static readonly decks: Deck[] = [
         { edition: 'mobileapp', version: '1.1', lang: ['en', 'hi', 'uk'] },
         { edition: 'webapp', version: '3.0', lang: ['en', 'es', 'fr', 'nl', 'no_nb', 'pt_br', 'pt_pt', 'ru', 'it', 'hi', 'uk'] },
         { edition: 'webapp', version: '2.2', lang: ['en', 'es', 'fr', 'nl', 'no_nb', 'pt_br', 'pt_pt', 'ru', 'it'] },
         { edition: 'companion', version: '1.0', lang: ['en'] },
+        { edition: 'eop', version: '5.0', lang: ['en'] },
         { edition: 'dbd', version: '1.0', lang: ['en'] }
     ];
 
diff --git a/cornucopia.owasp.org/src/lib/services/deckServiceConsts.ts b/cornucopia.owasp.org/src/lib/services/deckServiceConsts.ts
index 7b9ddc695..f37bcce68 100644
--- a/cornucopia.owasp.org/src/lib/services/deckServiceConsts.ts
+++ b/cornucopia.owasp.org/src/lib/services/deckServiceConsts.ts
@@ -4,4 +4,5 @@
 export const VERSION_WEBAPP = "webapp";
 export const VERSION_MOBILEAPP = "mobileapp";
 export const VERSION_COMPANION = "companion";
-export const VERSION_DBD = "dbd";
\ No newline at end of file
+export const VERSION_DBD = "dbd";
+export const VERSION_EOP = "eop";
\ No newline at end of file
diff --git a/cornucopia.owasp.org/src/routes/cards/+page.server.ts b/cornucopia.owasp.org/src/routes/cards/+page.server.ts
index cd75ea94c..7cf78e3d4 100644
--- a/cornucopia.owasp.org/src/routes/cards/+page.server.ts
+++ b/cornucopia.owasp.org/src/routes/cards/+page.server.ts
@@ -2,21 +2,23 @@ import { DeckService } from '$lib/services/deckService';
 import { SuitController } from '../../domain/suit/suitController';
 import { FileSystemHelper } from '$lib/filesystem/fileSystemHelper';
 import { MappingService } from '$lib/services/mappingService';
- 
+
 export const load = (({ params: _params }) => {
   const deckService = new DeckService();
   const decks = new Map<string, Map<string, unknown>>();
   const lang = 'en';
   const mobileCards = deckService.getCardDataForEditionVersionLang(
-  'mobileapp', DeckService.getLatestVersion('mobileapp'), lang);
+    'mobileapp', DeckService.getLatestVersion('mobileapp'), lang);
   const webappCards = deckService.getCardDataForEditionVersionLang(
     'webapp', DeckService.getLatestVersion('webapp'), lang);
   const companionCards = deckService.getCardDataForEditionVersionLang(
     'companion', DeckService.getLatestVersion('companion'), lang);
-  
+  const eopCards = deckService.getCardDataForEditionVersionLang(
+    'eop', DeckService.getLatestVersion('eop'), lang);
+
   return {
-    suits : SuitController.getSuits(),
-    decks : decks.set(lang, new Map([...mobileCards, ...webappCards, ...companionCards])),
+    suits: SuitController.getSuits(),
+    decks: decks.set(lang, new Map([...mobileCards, ...webappCards, ...companionCards, ...eopCards])),
     mappingData: (new MappingService()).getCardMappingForLatestEdtions(),
     content: FileSystemHelper.getDataFromPath('data/website/pages/cards')
   };
diff --git a/cornucopia.owasp.org/src/routes/cards/+page.svelte b/cornucopia.owasp.org/src/routes/cards/+page.svelte
index ac1b258b9..deea05955 100644
--- a/cornucopia.owasp.org/src/routes/cards/+page.svelte
+++ b/cornucopia.owasp.org/src/routes/cards/+page.svelte
@@ -9,7 +9,7 @@
     import { readLang, readTranslation } from '$lib/stores/stores';
     import type { Suit } from "../../domain/suit/suit.js";
     import { SvelteMap } from 'svelte/reactivity';
-    import { VERSION_WEBAPP, VERSION_MOBILEAPP, VERSION_COMPANION } from "$lib/services/deckServiceConsts";
+    import { VERSION_WEBAPP, VERSION_MOBILEAPP, VERSION_COMPANION, VERSION_EOP } from "$lib/services/deckServiceConsts";
 
     interface Props {
         data: PageData;
@@ -40,6 +40,11 @@
         return langSuits || suits?.get(`${VERSION_COMPANION}-en`) as Suit[];
     });
 
+    let eopSuits = $derived.by(() => {
+        const langSuits = suits?.get(`${VERSION_EOP}-${$lang}`);
+        return langSuits || suits?.get(`${VERSION_EOP}-en`) as Suit[];
+    });
+
     let version : string = $state(VERSION_WEBAPP);
     let _suit : string;
     let card : Card = $derived(cards?.get('VE2') as Card);
@@ -68,6 +73,11 @@
         {
             if (companionSuits !== undefined && typeof companionSuits[i] !== 'undefined') map.set(companionSuits[i]?.name,expand);
         }
+
+        for(let i = 0 ; i < eopSuits?.length ; i++)
+        {
+            if (eopSuits !== undefined && typeof eopSuits[i] !== 'undefined') map.set(eopSuits[i]?.name,expand);
+        }
     }
 
     function toggle(suit : string)
@@ -91,6 +101,9 @@
         
         if(version == VERSION_COMPANION)
         card = cards?.get('AAI2') as Card;
+
+        if(version == VERSION_EOP)
+        card = cards?.get('SP2') as Card;
     }
 
 
@@ -120,6 +133,7 @@
     <button title="OWASP Cornucopia {$t('cards.button.1')}" class:button-selected={version == VERSION_WEBAPP} onclick={()=>changeVersion(VERSION_WEBAPP)}>{$t('cards.button.1')}</button>
     <button title="OWASP Cornucopia {$t('cards.button.2')}" class:button-selected={version == VERSION_MOBILEAPP} onclick={()=>changeVersion(VERSION_MOBILEAPP)}>{$t('cards.button.2')}</button>
     <button title="OWASP Cornucopia {$t('cards.button.3')}" class:button-selected={version == VERSION_COMPANION} onclick={()=>changeVersion(VERSION_COMPANION)}>{$t('cards.button.3')}</button>
+    <button title="OWASP Cornucopia {$t('cards.button.4')}" class:button-selected={version == VERSION_EOP} onclick={()=>changeVersion(VERSION_EOP)}>{$t('cards.button.4')}</button>
 </p>
 </section>
 <div class="script">
@@ -150,6 +164,13 @@
         {@html $t('cards.p4')}
     </p>
     {/if}
+    {#if version == VERSION_EOP}
+    <h2 title="OWASP Cornucopia {$t('cards.h2.4')}">{$t('cards.h2.4')}</h2>
+    <p class="text">
+        <!-- eslint-disable-next-line svelte/no-at-html-tags -->
+        {@html $t('cards.p5')}
+    </p>
+    {/if}
     <div class="container">
         <div class="tree">
 
@@ -195,6 +216,20 @@
                     {/if}
                 {/each}
             {/if}
+
+            {#if version == VERSION_EOP}
+                {#each eopSuits as suit (suit.name)}
+                    <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
+                    <h3 title="OWASP Cornucopia {Text.Format(suit.name).toUpperCase()} suit" onkeypress={()=>toggle(suit.name)} onclick={()=>toggle(suit.name)}>&#x2514;&#9472;&#9472; {Text.Format(suit.name).toUpperCase()}</h3>
+                    {#if map?.get(suit.name)}
+                        {#each suit.cards as card (card)}
+                            <p onmouseenter={()=>{enter(suit.name,cards?.get(card)?.id)}}>
+                            <a title="OWASP Cornucopia {Text.Format(suit.name).toUpperCase()}, {cards?.get(card)?.id}" href={cards?.get(card)?.url ?? ''}>&#9500;&#9472;&#9472; {cards?.get(card)?.id}</a>
+                            </p>
+                        {/each}
+                    {/if}
+                {/each}
+            {/if}
         </div>
         <div class="preview-container">
                 <CardPreview {card} {mapping} style="preview-card-container"></CardPreview>
@@ -260,7 +295,28 @@
                 {/each}
                 </div>
             {/each}
-        </div>-
+        </div>
+    </div>
+    <div class="">
+        <div>
+            <h2 title="OWASP Cornucopia {$t('cards.h2.4')}">{$t('cards.h2.4')}</h2>
+            <p class="text">
+                <!-- eslint-disable-next-line svelte/no-at-html-tags -->
+                {@html $t('cards.p5')}
+            </p>
+            {#each eopSuits as suit (suit.name)}
+                <label for="{suit.name + '-eop'}" class="suit-button"><span class="label">&#x2514;&#9472;&#9472; {Text.Format(suit.name).toUpperCase()}</span></label>
+                <input type=checkbox class="suit-button" id="{suit.name + '-eop'}"/>
+                <div class="card-buttons">
+                {#each suit.cards as card (card)}
+                    <p>
+                        <a title="OWASP Cornucopia card: {cards?.get(card)?.id} from suit: {Text.Format(suit.name).toUpperCase()}" href={cards?.get(card)?.url ?? ''}>&#9500;&#9472;&#9472; {cards?.get(card)?.id}</a>
+                    </p>
+                {/each}
+                </div>
+            {/each}
+        </div>
+    </div>
 </noscript>
 </div>
 <style>
diff --git a/cornucopia.owasp.org/src/routes/cards/[card]/+page.server.ts b/cornucopia.owasp.org/src/routes/cards/[card]/+page.server.ts
index fda6bf94e..c27b1e370 100644
--- a/cornucopia.owasp.org/src/routes/cards/[card]/+page.server.ts
+++ b/cornucopia.owasp.org/src/routes/cards/[card]/+page.server.ts
@@ -29,7 +29,13 @@ export const load = (async ({ params }) => {
     lang
   );
 
-  const cards = new Map([...mobileCards, ...webappCards, ...companionCards]);
+  const eopCards = deckService.getCardDataForEditionVersionLang(
+    "eop",
+    DeckService.getLatestVersion("eop"),
+    lang
+  );
+
+  const cards = new Map([...mobileCards, ...webappCards, ...companionCards, ...eopCards]);
   const decks = new Map([["en", cards]]);
 
   const fixedCode = legacyCardCodeFix(params.card?.toUpperCase() || "");
diff --git a/cornucopia.owasp.org/src/routes/cards/[card]/+page.svelte b/cornucopia.owasp.org/src/routes/cards/[card]/+page.svelte
index 09ee56209..94a56ec0a 100644
--- a/cornucopia.owasp.org/src/routes/cards/[card]/+page.svelte
+++ b/cornucopia.owasp.org/src/routes/cards/[card]/+page.svelte
@@ -40,6 +40,12 @@
       "DVOA","DVO2","DVO3","DVO4","DVO5","DVO6","DVO7","DVO8","DVO9","DVOX","DVOJ","DVOQ","DVOK",
       "SEA","SE2","SE3","SE4","SE5","SE6","SE7","SE8","SE9","SEX","SEJ","SEQ","SEK",
       "BOTA","BOT2","BOT3","BOT4","BOT5","BOT6","BOT7","BOT8","BOT9","BOTX","BOTJ","BOTQ","BOTK",
+      "SPA","SP2","SP3","SP4","SP5","SP6","SP7","SP8","SP9","SPX","SPJ","SPQ","SPK",
+      "TAA","TA2","TA3","TA4","TA5","TA6","TA7","TA8","TA9","TAX","TAJ","TAQ","TAK",
+      "REA","RE2","RE3","RE4","RE5","RE6","RE7","RE8","RE9","REX","REJ","REQ","REK",
+      "IDA","ID2","ID3","ID4","ID5","ID6","ID7","ID8","ID9","IDX","IDJ","IDQ","IDK",
+      "DSA","DS2","DS3","DS4","DS5","DS6","DS7","DS8","DS9","DSX","DSJ","DSQ","DSK",
+      "EPA","EP2","EP3","EP4","EP5","EP6","EP7","EP8","EP9","EPX","EPJ","EPQ","EPK",
       "JOA","JOB","JOAM","JOBM","CORNUCOPIA"]
     return (cards_options.includes(String(card?.id).toUpperCase()))
   }
@@ -48,6 +54,7 @@
     if (str == "webapp") return "Website App Edition";
     if (str == "mobileapp") return "Mobile App Edition";
     if (str == "companion") return "Companion Edition";
+    if (str == "eop") return "Elevation of Privilege Edition";
     return str;
   }
 </script>
diff --git a/cornucopia.owasp.org/src/routes/edition/[edition]/+page.svelte b/cornucopia.owasp.org/src/routes/edition/[edition]/+page.svelte
index b2c6568c4..9d9d79ed8 100644
--- a/cornucopia.owasp.org/src/routes/edition/[edition]/+page.svelte
+++ b/cornucopia.owasp.org/src/routes/edition/[edition]/+page.svelte
@@ -10,7 +10,7 @@
     import type { Suit } from "$domain/suit/suit.js";
     import { SvelteMap } from 'svelte/reactivity';
     import { goto } from "$app/navigation";
-    import { VERSION_WEBAPP, VERSION_MOBILEAPP, VERSION_COMPANION } from "$lib/services/deckServiceConsts";
+    import { VERSION_WEBAPP, VERSION_MOBILEAPP, VERSION_COMPANION, VERSION_EOP } from "$lib/services/deckServiceConsts";
 
 
     interface Props {
@@ -40,6 +40,7 @@
         if (version === VERSION_MOBILEAPP) return cards.get('PC2') as Card;
         if (version === VERSION_WEBAPP) return cards.get('VE2') as Card;
         if (version === VERSION_COMPANION) return cards.get('AAI2') as Card;
+        if (version === VERSION_EOP) return cards.get('SP2') as Card;
         return cards.get('VE2') as Card;
     });
 
@@ -103,6 +104,7 @@
     <button title="OWASP Cornucopia {$t('cards.button.1')}" class:button-selected={version == VERSION_WEBAPP} onclick={()=>changeVersion(VERSION_WEBAPP)}>{$t('cards.button.1')}</button>
     <button title="OWASP Cornucopia {$t('cards.button.2')}" class:button-selected={version == VERSION_MOBILEAPP} onclick={()=>changeVersion(VERSION_MOBILEAPP)}>{$t('cards.button.2')}</button>
     <button title="OWASP Cornucopia {$t('cards.button.3')}" class:button-selected={version == VERSION_COMPANION} onclick={()=>changeVersion(VERSION_COMPANION)}>{$t('cards.button.3')}</button>
+    <button title="OWASP Cornucopia {$t('cards.button.4')}" class:button-selected={version == VERSION_EOP} onclick={()=>changeVersion(VERSION_EOP)}>{$t('cards.button.4')}</button>
 </p>
 </section>
 <div class="script">
@@ -133,6 +135,13 @@
         {@html $t('cards.p4')}
     </p>
     {/if}
+    {#if version == VERSION_EOP}
+    <h2 title="OWASP Cornucopia {$t('cards.h2.4')}">{$t('cards.h2.4')}</h2>
+    <p class="text">
+        <!-- eslint-disable-next-line svelte/no-at-html-tags -->
+        {@html $t('cards.p5')}
+    </p>
+    {/if}
     <div class="container">
         <div class="tree">
             {#each cardSuits as suit (suit.name)}
@@ -176,6 +185,13 @@
                     {@html $t('cards.p4')}
                 </p>
             {/if}
+            {#if version == VERSION_EOP}
+                <h2 title="OWASP Cornucopia {$t('cards.h2.4')}">{$t('cards.h2.4')}</h2>
+                <p class="text">
+                    <!-- eslint-disable-next-line svelte/no-at-html-tags -->
+                    {@html $t('cards.p5')}
+                </p>
+            {/if}
             {#each cardSuits as suit (suit.name)}
                  {#if version == VERSION_WEBAPP}
                     <label for="{suit.name + '-web'}" class="suit-button"><span class="label">&#x2514;&#9472;&#9472; {Text.Format(suit.name).toUpperCase()}</span></label>
@@ -189,6 +205,10 @@
                     <label for="{suit.name + '-companion'}" class="suit-button"><span class="label">&#x2514;&#9472;&#9472; {Text.Format(suit.name).toUpperCase()}</span></label>
                     <input type=checkbox class="suit-button" id="{suit.name + '-companion'}"/>
                 {/if}
+                {#if version == VERSION_EOP}
+                    <label for="{suit.name + '-eop'}" class="suit-button"><span class="label">&#x2514;&#9472;&#9472; {Text.Format(suit.name).toUpperCase()}</span></label>
+                    <input type=checkbox class="suit-button" id="{suit.name + '-eop'}"/>
+                {/if}
                 <div class="card-buttons">
                 {#each suit.cards as card (card)}
                     <p>
diff --git a/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/+page.svelte b/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/+page.svelte
index a4ab02f46..3d36d278f 100644
--- a/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/+page.svelte
+++ b/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/+page.svelte
@@ -38,6 +38,12 @@
       "DVOA","DVO2","DVO3","DVO4","DVO5","DVO6","DVO7","DVO8","DVO9","DVOX","DVOJ","DVOQ","DVOK",
       "SEA","SE2","SE3","SE4","SE5","SE6","SE7","SE8","SE9","SEX","SEJ","SEQ","SEK",
       "BOTA","BOT2","BOT3","BOT4","BOT5","BOT6","BOT7","BOT8","BOT9","BOTX","BOTJ","BOTQ","BOTK",
+      "SPA","SP2","SP3","SP4","SP5","SP6","SP7","SP8","SP9","SPX","SPJ","SPQ","SPK",
+      "TAA","TA2","TA3","TA4","TA5","TA6","TA7","TA8","TA9","TAX","TAJ","TAQ","TAK",
+      "REA","RE2","RE3","RE4","RE5","RE6","RE7","RE8","RE9","REX","REJ","REQ","REK",
+      "IDA","ID2","ID3","ID4","ID5","ID6","ID7","ID8","ID9","IDX","IDJ","IDQ","IDK",
+      "DSA","DS2","DS3","DS4","DS5","DS6","DS7","DS8","DS9","DSX","DSJ","DSQ","DSK",
+      "EPA","EP2","EP3","EP4","EP5","EP6","EP7","EP8","EP9","EPX","EPJ","EPQ","EPK",
       "JOA","JOB","JOAM","JOBM","CORNUCOPIA"]
     return (cards_options.includes(String(card?.id).toUpperCase()))
   }
@@ -46,6 +52,7 @@
     if (str == "webapp") return "Website App Edition";
     if (str == "mobileapp") return "Mobile App Edition";
     if (str == "companion") return "Companion Edition";
+    if (str == "eop") return "Elevation of Privilege Edition";
     return str;
   }
 </script>
diff --git a/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/+page.svelte b/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/+page.svelte
index 7a110e19e..9d0cdb67e 100644
--- a/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/+page.svelte
+++ b/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/+page.svelte
@@ -39,6 +39,12 @@
       "DVOA","DVO2","DVO3","DVO4","DVO5","DVO6","DVO7","DVO8","DVO9","DVOX","DVOJ","DVOQ","DVOK",
       "SEA","SE2","SE3","SE4","SE5","SE6","SE7","SE8","SE9","SEX","SEJ","SEQ","SEK",
       "BOTA","BOT2","BOT3","BOT4","BOT5","BOT6","BOT7","BOT8","BOT9","BOTX","BOTJ","BOTQ","BOTK",
+      "SPA","SP2","SP3","SP4","SP5","SP6","SP7","SP8","SP9","SPX","SPJ","SPQ","SPK",
+      "TAA","TA2","TA3","TA4","TA5","TA6","TA7","TA8","TA9","TAX","TAJ","TAQ","TAK",
+      "REA","RE2","RE3","RE4","RE5","RE6","RE7","RE8","RE9","REX","REJ","REQ","REK",
+      "IDA","ID2","ID3","ID4","ID5","ID6","ID7","ID8","ID9","IDX","IDJ","IDQ","IDK",
+      "DSA","DS2","DS3","DS4","DS5","DS6","DS7","DS8","DS9","DSX","DSJ","DSQ","DSK",
+      "EPA","EP2","EP3","EP4","EP5","EP6","EP7","EP8","EP9","EPX","EPJ","EPQ","EPK",
       "JOA","JOB","JOAM","JOBM","CORNUCOPIA"]
     return (cards_options.includes(String(card?.id).toUpperCase()))
   }
@@ -47,6 +53,7 @@
     if (str == "webapp") return "Website App Edition";
     if (str == "mobileapp") return "Mobile App Edition";
     if (str == "companion") return "Companion Edition";
+    if (str == "eop") return "Elevation of Privilege Edition";
     return str;
   }
 </script>
diff --git a/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/[lang]/+page.svelte b/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/[lang]/+page.svelte
index af0bef92a..e0eee0619 100644
--- a/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/[lang]/+page.svelte
+++ b/cornucopia.owasp.org/src/routes/edition/[edition]/[card]/[version]/[lang]/+page.svelte
@@ -34,6 +34,12 @@
       "DVOA","DVO2","DVO3","DVO4","DVO5","DVO6","DVO7","DVO8","DVO9","DVOX","DVOJ","DVOQ","DVOK",
       "SEA","SE2","SE3","SE4","SE5","SE6","SE7","SE8","SE9","SEX","SEJ","SEQ","SEK",
       "BOTA","BOT2","BOT3","BOT4","BOT5","BOT6","BOT7","BOT8","BOT9","BOTX","BOTJ","BOTQ","BOTK",
+      "SPA","SP2","SP3","SP4","SP5","SP6","SP7","SP8","SP9","SPX","SPJ","SPQ","SPK",
+      "TAA","TA2","TA3","TA4","TA5","TA6","TA7","TA8","TA9","TAX","TAJ","TAQ","TAK",
+      "REA","RE2","RE3","RE4","RE5","RE6","RE7","RE8","RE9","REX","REJ","REQ","REK",
+      "IDA","ID2","ID3","ID4","ID5","ID6","ID7","ID8","ID9","IDX","IDJ","IDQ","IDK",
+      "DSA","DS2","DS3","DS4","DS5","DS6","DS7","DS8","DS9","DSX","DSJ","DSQ","DSK",
+      "EPA","EP2","EP3","EP4","EP5","EP6","EP7","EP8","EP9","EPX","EPJ","EPQ","EPK",
       "JOA","JOB","JOAM","JOBM","CORNUCOPIA"]
     return (cards_options.includes(String(card?.id).toUpperCase()))
   }
@@ -42,6 +48,7 @@
     if (str == "webapp") return "Website App Edition";
     if (str == "mobileapp") return "Mobile App Edition";
     if (str == "companion") return "Companion Edition";
+    if (str == "eop") return "Elevation of Privilege Edition";
     return str;
   }
 </script>
diff --git a/cornucopia.owasp.org/static/css/base.css b/cornucopia.owasp.org/static/css/base.css
index f148458e4..eedf46ed7 100644
--- a/cornucopia.owasp.org/static/css/base.css
+++ b/cornucopia.owasp.org/static/css/base.css
@@ -1,4 +1,40 @@
 /* This file contains all base styling and CSS variables */
+
+@font-face {
+  font-family: "Segoe";
+  font-style: normal;
+  font-weight: 400;
+  src: local("Segoe"), url("/fonts/segoe.woff") format("woff");
+}
+
+@font-face {
+  font-family: "Segoe Light";
+  font-style: normal;
+  font-weight: 300;
+  src: local("Segoe"), url("/fonts/segoe-light.woff") format("woff");
+}
+
+@font-face {
+  font-family: "Segoe UI";
+  font-style: normal;
+  font-weight: 400;
+  src: local("Segoe"), url("/fonts/segoe-ui.woff") format("woff");
+}
+
+@font-face {
+  font-family: "Segoe Condensed";
+  font-style: normal;
+  font-weight: 400;
+  src: local("Segoe Condensed"), url("/fonts/segoe-condensed.woff") format("woff");
+}
+
+@font-face {
+  font-family: "Segoe Condensed";
+  font-style: normal;
+  font-weight: 700;
+  src: local("Segoe Condensed"), url("/fonts/segoe-condensed-bold.woff") format("woff");
+}
+
 :root {
   --accent: #61b6e6;
   --background: #1f2937;
diff --git a/cornucopia.owasp.org/static/fonts/segoe-condensed-bold.woff b/cornucopia.owasp.org/static/fonts/segoe-condensed-bold.woff
new file mode 100644
index 000000000..e364e8090
Binary files /dev/null and b/cornucopia.owasp.org/static/fonts/segoe-condensed-bold.woff differ
diff --git a/cornucopia.owasp.org/static/fonts/segoe-condensed.woff b/cornucopia.owasp.org/static/fonts/segoe-condensed.woff
new file mode 100644
index 000000000..30540a64e
Binary files /dev/null and b/cornucopia.owasp.org/static/fonts/segoe-condensed.woff differ
diff --git a/cornucopia.owasp.org/static/fonts/segoe-light.woff b/cornucopia.owasp.org/static/fonts/segoe-light.woff
new file mode 100644
index 000000000..ed3d050db
Binary files /dev/null and b/cornucopia.owasp.org/static/fonts/segoe-light.woff differ
diff --git a/cornucopia.owasp.org/static/fonts/segoe-ui.woff b/cornucopia.owasp.org/static/fonts/segoe-ui.woff
new file mode 100644
index 000000000..a45efa328
Binary files /dev/null and b/cornucopia.owasp.org/static/fonts/segoe-ui.woff differ
diff --git a/cornucopia.owasp.org/static/fonts/segoe.woff b/cornucopia.owasp.org/static/fonts/segoe.woff
new file mode 100644
index 000000000..1e1631d6b
Binary files /dev/null and b/cornucopia.owasp.org/static/fonts/segoe.woff differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-10.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-10.png
new file mode 100644
index 000000000..7bd249519
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-10.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-2.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-2.png
new file mode 100644
index 000000000..b4de6a505
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-2.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-3.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-3.png
new file mode 100644
index 000000000..a0821aa4f
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-3.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-4.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-4.png
new file mode 100644
index 000000000..1e0ac9c42
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-4.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-5.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-5.png
new file mode 100644
index 000000000..7256904ba
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-5.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-6.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-6.png
new file mode 100644
index 000000000..1643d1c6d
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-6.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-7.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-7.png
new file mode 100644
index 000000000..075e89526
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-7.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-8.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-8.png
new file mode 100644
index 000000000..daf3da735
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-8.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-9.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-9.png
new file mode 100644
index 000000000..282324b67
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-9.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-a.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-a.png
new file mode 100644
index 000000000..09fbca073
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-a.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-j.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-j.png
new file mode 100644
index 000000000..b28c75c00
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-j.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-k.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-k.png
new file mode 100644
index 000000000..deed0ff0c
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-k.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-q.png b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-q.png
new file mode 100644
index 000000000..c7d16224e
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/denial-of-service-q.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-10.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-10.png
new file mode 100644
index 000000000..f48ad4442
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-10.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-2.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-2.png
new file mode 100644
index 000000000..3e092d3bb
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-2.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-3.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-3.png
new file mode 100644
index 000000000..44aac252d
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-3.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-4.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-4.png
new file mode 100644
index 000000000..7ccfbe246
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-4.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-5.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-5.png
new file mode 100644
index 000000000..686981a84
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-5.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-6.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-6.png
new file mode 100644
index 000000000..fb5feea07
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-6.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-7.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-7.png
new file mode 100644
index 000000000..bf934cfdc
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-7.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-8.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-8.png
new file mode 100644
index 000000000..402312db5
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-8.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-9.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-9.png
new file mode 100644
index 000000000..a718aeefe
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-9.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-a.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-a.png
new file mode 100644
index 000000000..1d2b7b9f2
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-a.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-j.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-j.png
new file mode 100644
index 000000000..ca7471242
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-j.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-k.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-k.png
new file mode 100644
index 000000000..bc51278b5
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-k.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-q.png b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-q.png
new file mode 100644
index 000000000..34e89dc0b
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/elevation-of-privilege-q.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-10.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-10.png
new file mode 100644
index 000000000..257726d0c
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-10.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-2.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-2.png
new file mode 100644
index 000000000..1e96a9c8e
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-2.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-3.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-3.png
new file mode 100644
index 000000000..296ad5a15
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-3.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-4.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-4.png
new file mode 100644
index 000000000..fefe35a4b
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-4.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-5.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-5.png
new file mode 100644
index 000000000..b1dbf7c32
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-5.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-6.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-6.png
new file mode 100644
index 000000000..c09bd6936
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-6.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-7.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-7.png
new file mode 100644
index 000000000..a36c0064d
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-7.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-8.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-8.png
new file mode 100644
index 000000000..196df02c2
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-8.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-9.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-9.png
new file mode 100644
index 000000000..9fded7498
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-9.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-a.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-a.png
new file mode 100644
index 000000000..a50d75838
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-a.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-j.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-j.png
new file mode 100644
index 000000000..b63ab0e55
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-j.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-k.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-k.png
new file mode 100644
index 000000000..7d51d156b
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-k.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-q.png b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-q.png
new file mode 100644
index 000000000..acc178cea
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/information-disclosure-q.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-10.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-10.png
new file mode 100644
index 000000000..2e82e5974
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-10.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-2.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-2.png
new file mode 100644
index 000000000..58cc8bc60
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-2.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-3.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-3.png
new file mode 100644
index 000000000..98ff9557c
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-3.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-4.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-4.png
new file mode 100644
index 000000000..a880380c5
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-4.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-5.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-5.png
new file mode 100644
index 000000000..905880663
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-5.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-6.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-6.png
new file mode 100644
index 000000000..267686972
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-6.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-7.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-7.png
new file mode 100644
index 000000000..433e53c8b
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-7.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-8.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-8.png
new file mode 100644
index 000000000..e42f370c1
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-8.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-9.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-9.png
new file mode 100644
index 000000000..78e2caa8b
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-9.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-a.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-a.png
new file mode 100644
index 000000000..ffcaf395d
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-a.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-j.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-j.png
new file mode 100644
index 000000000..0fe010995
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-j.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-k.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-k.png
new file mode 100644
index 000000000..4a34878cf
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-k.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/repudiation-q.png b/cornucopia.owasp.org/static/images/eop-cards/repudiation-q.png
new file mode 100644
index 000000000..d243343cb
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/repudiation-q.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-10.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-10.png
new file mode 100644
index 000000000..a69e397df
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-10.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-2.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-2.png
new file mode 100644
index 000000000..4a98e880b
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-2.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-3.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-3.png
new file mode 100644
index 000000000..d3f7321d0
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-3.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-4.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-4.png
new file mode 100644
index 000000000..878e16849
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-4.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-5.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-5.png
new file mode 100644
index 000000000..0f72ad26d
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-5.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-6.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-6.png
new file mode 100644
index 000000000..962bc380a
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-6.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-7.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-7.png
new file mode 100644
index 000000000..d30bf0619
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-7.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-8.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-8.png
new file mode 100644
index 000000000..a17676497
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-8.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-9.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-9.png
new file mode 100644
index 000000000..d06bd16df
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-9.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-a.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-a.png
new file mode 100644
index 000000000..ccb9eb7f9
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-a.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-j.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-j.png
new file mode 100644
index 000000000..181f57af5
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-j.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-k.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-k.png
new file mode 100644
index 000000000..c4eb3c862
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-k.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/spoofing-q.png b/cornucopia.owasp.org/static/images/eop-cards/spoofing-q.png
new file mode 100644
index 000000000..af70b6fe6
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/spoofing-q.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-10.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-10.png
new file mode 100644
index 000000000..e4b6748b5
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-10.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-2.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-2.png
new file mode 100644
index 000000000..3bd831039
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-2.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-3.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-3.png
new file mode 100644
index 000000000..25e46d560
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-3.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-4.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-4.png
new file mode 100644
index 000000000..7e6139e8d
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-4.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-5.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-5.png
new file mode 100644
index 000000000..767b057fd
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-5.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-6.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-6.png
new file mode 100644
index 000000000..b6eebd2f0
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-6.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-7.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-7.png
new file mode 100644
index 000000000..92263a9ae
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-7.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-8.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-8.png
new file mode 100644
index 000000000..11ea20c73
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-8.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-9.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-9.png
new file mode 100644
index 000000000..22d920afa
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-9.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-a.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-a.png
new file mode 100644
index 000000000..452e58245
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-a.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-j.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-j.png
new file mode 100644
index 000000000..3ea49cdfe
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-j.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-k.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-k.png
new file mode 100644
index 000000000..9ac1df1b1
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-k.png differ
diff --git a/cornucopia.owasp.org/static/images/eop-cards/tampering-q.png b/cornucopia.owasp.org/static/images/eop-cards/tampering-q.png
new file mode 100644
index 000000000..5b075ba53
Binary files /dev/null and b/cornucopia.owasp.org/static/images/eop-cards/tampering-q.png differ