OWASP Mobile Application Security Verification Standard

This is the official Github Repository of the OWASP Mobile Application Security Verification Standard (MASVS). The MASVS establishes baseline security requirements for mobile apps that are useful in many scenarios, including:

• In the SDLC - to establish security requirements to be followed by solution architects and developers;
• In mobile app penetration tests - to ensure completeness and consistency in mobile app penetration tests;
• In procurement - as a measuring stick for mobile app security, e.g. in form of questionnaire for vendors;
• Et cetera.

The MASVS is a sister project of the OWASP Mobile Security Testing Guide.

Getting the MASVS

PDF/Mobi/Epub/Docx downloads are available on the Releases page. The documents were created by using pandocker.

The current release of the MASVS is version 1.2. Want to have the latest snapshot version? Check the latest Github build action. The MASVS is also available in different languages:

• Brazilian Portuguese
• Chinese (Simplified) - ZHCN
• Chinese (Traditional) - ZHTW
• English
• French
• German
• Hindi (in progress)
• Japanese
• Korean
• Persian
• Russian
• Spanish

Gitbook

Read the English version on Gitbook. The book is automatically synchronized with the main repo.

Create new PDF, Epub, Mobi, and Word document

You can find the documents in the release page. If you want to generate the documents yourself, execute the following steps. Clone the repository and run the document generator. This produces PDF, Epub and Docx files in the root of the project.

$ git clone https://github.com/OWASP/owasp-masvs/
$ cd owasp-masvs/tools/docker
$ ./run_docker_masvs_generation_on_local.sh LATEST

Exporting to JSON, XML and CSV

The repository contains a Python tool for converting the requirements into various formats. Clone the repo and run export.py from the tools folder.

export.py [-h] [--format {json,xml,csv}] [--lang {es/ru/en/fr/de/zhtw/ja}]

Suggestions and Feedback

To report and error or suggest an improvement, please create an issue or create a Pull Request.

How to Contribute

The MASVS is an open source effort and we welcome contributions and feedback. If you want to contribute additional content, or improve existing content, we suggest that you first contact us on the OWASP MSTG Slack channel:

https://owasp.slack.com/messages/project-mobile_omtg/details/

You can sign up here:

https://owasp.slack.com/join/shared_invite/zt-g398htpy-AZ40HOM1WUOZguJKbblqkw#/

Before you start contributing, please check our contribution guide which should get you started.

Read Individual Sections of the MASVS Here

• Foreword
• Frontispiece
• The Mobile Application Security Verification Standard
• Assessment and Verification
• V1: Architecture, Design and Threat Modeling Requirements
• V2: Data Storage and Privacy Requirements
• V3: Cryptography Requirements
• V4: Authentication and Session Management Requirements
• V5: Network Communication Requirements
• V6: Environmental Interaction Requirements
• V7: Code Quality and Build Setting Requirements
• V8: Resiliency Against Reverse Engineering Requirements
• Appendix A: Glossary
• Appendix B: References
• Release notes