Mobile App Security Checklist

What this checklist is

A mobile app security checklist for Android, iOS, Flutter and React Native apps, organised by the eight OWASP MASVS categories. Every check says how much it matters and how to verify it on a real build, using platform tools or the techniques in the OWASP Mobile Application Security Testing Guide.

It has 8 chapters and 36 checks, each with how to verify it and how much it matters. For Android, iOS and cross-platform developers.

Chapter by chapter

1. Data storage (MASVS-STORAGE) (6 checks)

Checks that secrets never ship in the app, and that sensitive data kept on the device stays in the app sandbox, protected by platform key storage.

2. Cryptography (MASVS-CRYPTO) (3 checks)

Checks that the app uses platform cryptography correctly, with keys generated and held by the platform rather than written into code.

3. Network communication (MASVS-NETWORK) (5 checks)

Checks that every connection uses TLS that is actually validated, with no debug shortcuts left in release builds.

4. Authentication and sessions (MASVS-AUTH) (5 checks)

Checks that the server makes every access decision, and that tokens on the device are short-lived, protected and revocable.

5. Platform interaction (MASVS-PLATFORM) (5 checks)

Checks on how the app exposes itself to other apps and to web content: components, intents, deep links, WebViews and permissions.

6. Code quality and dependencies (MASVS-CODE) (6 checks)

Checks that release builds are built for release, dependencies stay current, and the app treats server and local data with care.

7. Resilience and app integrity (MASVS-RESILIENCE) (3 checks)

Checks for apps that need to detect tampering or abuse, with the server, not the app, making the final decision.

8. Privacy (MASVS-PRIVACY) (3 checks)

Checks that the app collects only what it needs, says honestly what it collects, and gives users control.

How it works on Sefism

The checklist is one page: each check has a severity (must, should or nice to have) and a concrete way to verify it, and members can tick checks off as they go. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.

Every claim is checked against the sources listed on the page (7 cited).