Reference library
MASVS control reference
OWASP MASVS v2 controls and the evidence available from static analysis. Manual-review controls remain explicitly outside static scope.
Browse the library
The app securely stores sensitive data.
how the app stores sensitive data at rest and whether it prevents that data from leaking.
The app prevents leakage of sensitive data.
how the app stores sensitive data at rest and whether it prevents that data from leaking.
The app employs current strong cryptography and uses it according to best practices.
whether the app uses strong, current cryptography and manages its keys correctly.
The app performs key management according to best practices.
whether the app uses strong, current cryptography and manages its keys correctly.
The app uses secure authentication and authorization protocols.
how the app authenticates users and authorizes sensitive actions — largely server-side and runtime, so mostly outside static-analysis scope.
The app performs local authentication securely.
how the app authenticates users and authorizes sensitive actions — largely server-side and runtime, so mostly outside static-analysis scope.
The app secures sensitive operations with additional authentication.
how the app authenticates users and authorizes sensitive actions — largely server-side and runtime, so mostly outside static-analysis scope.
The app secures all network traffic according to current best practices.
whether network traffic is encrypted in transit and the remote endpoint's identity is verified.
The app verifies the identity of the remote endpoint (e.g. certificate pinning).
whether network traffic is encrypted in transit and the remote endpoint's identity is verified.
The app uses IPC mechanisms securely.
how safely the app uses Android platform features — IPC and exported components, WebViews, and the user interface.
The app uses WebViews securely.
how safely the app uses Android platform features — IPC and exported components, WebViews, and the user interface.
The app uses the user interface securely.
how safely the app uses Android platform features — IPC and exported components, WebViews, and the user interface.
The app requires an up-to-date platform version.
platform currency, third-party dependency hygiene, and secure-coding practice.
The app has a mechanism for enforcing updates.
platform currency, third-party dependency hygiene, and secure-coding practice.
The app only uses software components without known vulnerabilities.
platform currency, third-party dependency hygiene, and secure-coding practice.
The app validates and sanitizes all untrusted inputs and follows secure-coding practice.
platform currency, third-party dependency hygiene, and secure-coding practice.
The app validates the integrity of the platform.
anti-tampering and integrity defenses — inherently runtime, so static analysis can only note their presence.
The app implements anti-tampering mechanisms.
anti-tampering and integrity defenses — inherently runtime, so static analysis can only note their presence.
The app implements anti-static-analysis mechanisms.
anti-tampering and integrity defenses — inherently runtime, so static analysis can only note their presence.
The app implements anti-dynamic-analysis techniques.
anti-tampering and integrity defenses — inherently runtime, so static analysis can only note their presence.
The app minimizes access to sensitive data and resources.
data minimization, user identifiability, transparency about collection, and user control over data.
The app prevents identification of the user.
data minimization, user identifiability, transparency about collection, and user control over data.
The app is transparent about data collection and usage.
data minimization, user identifiability, transparency about collection, and user control over data.
The app offers user control over their data.
data minimization, user identifiability, transparency about collection, and user control over data.
No matching records. Change or clear your filters.
Mappings describe review evidence. They do not establish exploitability, a compliance failure, or a clean result.