OWASP MASVS

MASVS is a verification standard: a structured list of security requirements for a mobile application, organised into areas such as storage, cryptography, authentication, network communication, platform interaction, code quality and resilience. Each requirement states what a secure app should do, so a team can define the level of assurance an app needs and verify against it. It is deliberately paired with a separate document, the MASTG (Mobile Application Security Testing Guide), which is the how-to that describes the techniques for checking each requirement. MASVS says what “secure” means; MASTG says how to test for it. They are two OWASP documents with different jobs, not two names for one thing, which is why a report cites the standard and the guide separately.

The failure a MASVS-driven test catches is the assumption that server-side controls are enough, so the client of the app is treated as trusted. On mobile that is wrong: the app runs on a device the user (or an attacker) controls fully, so anything the app protects only on the device can be reached. Recurring findings are sensitive data written to insecure local storage, secrets embedded in the app, and defences such as root and jailbreak detection or certificate pinning that raise the effort but can be bypassed on a controlled device. The standard forces coverage of these areas rather than testing only the parts a web-focused team would think to check.

We scope a mobile assessment against MASVS and report each finding against the requirement it fails, citing the standard so the reader can place our result against a published baseline. Coverage is stated explicitly, including areas assessed and found compliant, and where an app relies on client-side defences such as mobile app attestation we test whether they hold on a controlled device rather than assuming they do. The report reads like an OWASP Top 10 web report: named requirements, cited source, reproducible evidence. This is part of how we scope a mobile assessment against MASVS.