OWASP MASVS Security Review

When to Activate

Trigger this review when code touches any of the following areas:

• Sensitive data handling — tokens, passwords, PII, health data
• Authentication & session management — login, logout, token refresh, biometrics
• Networking — API calls, certificate configuration, TLS settings
• Local storage — databases, preferences, file system, caching
• Deep links & WebViews — URL schemes, intent filters, embedded web content
• Permissions & exported components — manifest declarations, runtime permissions

Review Checklist

1. Data Storage

2. Networking

3. Authentication & Session

4. Deep Links & WebViews

5. Permissions & Exported Components

6. Credentials & Secrets

How to Perform the Review

1. Identify scope — Determine which files and modules are affected.
2. Run checklist — Evaluate each applicable control against the code under review.
3. Classify findings:
   • FAIL — Immediate security risk. Blocks merge.
   • WARN — Potential risk or deviation from best practice. Requires justification to proceed.
   • PASS — Control verified and satisfied.
4. Generate report — Output findings in the format below.

Expected Output

## OWASP MASVS Audit Report

### FAIL (block merge)
- [FAIL] {Description of finding} — {file}:{line}
- [FAIL] {Description of finding} — {file}:{line}

### WARN (require justification)
- [WARN] {Description of finding} — {file}:{line}

### PASS
- [PASS] {Description of verified control}
- [PASS] {Description of verified control}

### Summary
- **FAIL**: {count}
- **WARN**: {count}
- **PASS**: {count}
- **Verdict**: {APPROVED / BLOCKED}

Severity Guidelines

References

• OWASP MASVS
• OWASP MASTG
• Android Security Best Practices
• Apple Platform Security