Use MASVS mappings in an assessment
Use recorded APK findings as input to a broader assessment, with coverage and limitations attached.
Last updated 2026-09-10
Read in context. These instructions need to be adapted to your app and platform version. New scans provide static detections; they do not establish current backend access. Current methodology.
Collect the recorded evidence
Review finding categories, SDK inventories, manifest settings, and build identifiers. Keep incomplete or unknown coverage visible in your assessment.
Identify the unanswered questions
Runtime behavior, configuration, audience, consent, and organizational processes require evidence beyond an APK scan.
Use the current guidance
Open the review guidance and primary references. Use qualified counsel or an assessor for a determination about your obligations.
Frequently asked questions
Does a scan establish compliance?
No. It supplies technical evidence within its recorded scope. Assessments require context and additional review.
How do I compare later builds?
Compare the build dates and coverage as well as findings. A missing detection alone does not prove a fix.