What is OWASP MASVS?
The OWASP Mobile Application Security Verification Standard (MASVS) is a list of security requirements for mobile apps. It describes what a secure Android or iOS app should do, organised into clear control areas, so teams have a shared definition of "secure enough" instead of opinions.
MASVS is maintained by the OWASP Foundation and is the most widely used reference for mobile app security. It pairs with the MASTG, which explains how to test each requirement.
The MASVS control groups
MASVS organises its requirements into a small set of control groups. In plain terms:
| Control group | What it asks |
|---|---|
| Storage | Sensitive data on the device is protected and not left in clear. |
| Crypto | Cryptography is strong and used correctly, with keys handled safely. |
| Auth | Authentication and session handling are sound, with checks on the server. |
| Network | Traffic is encrypted and certificates are verified. |
| Platform | The app uses platform features and permissions safely and limits its exposed surface. |
| Code | The app is built and signed properly, with no obvious code-quality weaknesses. |
| Resilience | Apps that need it resist tampering, reverse engineering and running on compromised devices. |
How Mobexa maps to MASVS
Mobexa tests the build you ship and tags every finding with the MASVS control it relates to. That turns a scan result into evidence: each issue points to a specific requirement, so engineering, security and audit all read the same map.
Findings also roll up from MASVS to the frameworks an auditor recognises, and export as SARIF for your pipeline. See framework coverage.
Common questions
What does MASVS stand for?
What is the difference between MASVS and MASTG?
Mobexa maps every finding on your Android and iOS builds to OWASP MASVS and the other standards an auditor recognises.
Start Free Trial