OWASP Mobile Application Security Verification Standard (MASVS)
This is the official Github Repository of the OWASP Mobile Application Security Verification Standard (MASVS). The MASVS establishes baseline security requirements for mobile apps that are useful in many scenarios. You can use it:
- As a metric - To provide a security standard against which existing mobile apps can be compared by developers and application owners.
- As guidance - To provide guidance during all phases of mobile app development and testing.
- During procurement - To provide a baseline for mobile app security verification.
The MASVS is a sister project of the OWASP Mobile Security Testing Guide.
- 📖 Read it on Gitbook (English Version, see more languages here)
- ⬇️ Download the latest PDF
- ✅ Get the latest Mobile App Security Checklists
- ⚡ Contribute!
- 💥 Play with our Crackmes
Trusted by ...
The OWASP MASVS and MSTG are trusted by the following platform providers and standardization, governmental and educational institutions. Learn more.
🥇 MSTG Advocates
MSTG Advocates are industry adopters of the OWASP MASVS and MSTG who have invested a significant and consistent amount of resources to push the project forward by providing consistent high-impact contributions and continuously spreading the word. Learn more.
Connect with Us
GitHub Discussions
#project-mobile_omtg (Get Invitation)
@OWASP_MSTG (Official Account)- @bsd_daemon (Sven Schleier, Project Lead) @grepharder (Carlos Holguera, Project Lead)
How to Contribute
The MASVS is an open source effort and we welcome all kinds of contributions and feedback.
Help us improve & join our community:
Contribute with content:
- 💡 Propose ideas or suggest improvements (if it qualifies we'll promote it to an Issue)
- 📄 Create a Pull Request for concrete fixes (e.g. grammar/typos) or content already approved by the core team.
Before you start contributing, please check our contribution guide which should get you started. If you have any doubts please contact us.
MASVS Translations
The MASVS is available in different languages:
- Chinese (Simplified) - ZHCN
- Chinese (Traditional) - ZHTW
- English
- French
- German
- Hindi
- Japanese
- Korean
- Persian
- Portuguese (Brazil)
- Portuguese (Portugal)
- Russian
- Spanish
Coming soon:
Your language is not here? We'd love to add it!
Other Formats
See the latest release. Else you can export it yourself in other formats.
Table-of-Contents
- Foreword
- Frontispiece
- The Mobile Application Security Verification Standard
- Assessment and Verification
- V1: Architecture, Design and Threat Modeling Requirements
- V2: Data Storage and Privacy Requirements
- V3: Cryptography Requirements
- V4: Authentication and Session Management Requirements
- V5: Network Communication Requirements
- V6: Environmental Interaction Requirements
- V7: Code Quality and Build Setting Requirements
- V8: Resiliency Against Reverse Engineering Requirements
- Appendix A: Glossary
- Appendix B: References
- Release notes