mastg

v1.9.0 Release Notes

This release spans January – December 2025 and is the largest in the project's history by volume: over 2,000 commits, dozens of v1→v2 test ports, a complete CWE mapping across all MASVS categories, new knowledge and best practice content, and several major structural milestones — including MASTG v2 graduating from beta, the MAS website moving to its own repository, and Guardsquare joining NowSecure as an OWASP MAS Advocate.

The year opened with the three-year anniversary of NowSecure as an OWASP MAS Advocate, reflecting on more than 320 pull requests, 230 reviews, and 42,000+ additions to the MASTG — a partnership that has been instrumental in driving the v2 refactor forward. Alongside this, the MAS Task Force (launched in February 2024) continued to meet monthly, coordinating the porting effort and shaping the project roadmap.

In May 2025, Guardsquare officially achieved MAS Advocate status — the highest recognition in the project. Their sustained contributions, including the bulk of the v1→v2 test ports in this release, and their key role in the OWASP Project Summit 2024, made them a natural fit. This release contains the most visible result of that commitment: a major wave of tests fully ported to the v2 format by Dennis Titze, Jan Seredynski, Nuno Antunes, and Pascal Jungblut.

The defining technical milestone of the year was the removal of the beta label from MASTG v2 and the deprecation of the legacy PDF format — a signal that the new modular structure is now the primary and stable reference. Alongside this, two major extractions reshaped the project structure: MASWE was temporarily moved to its own OWASP/maswe repository (and later re-integrated), and the MAS website was extracted to OWASP/mas-website, allowing each to evolve independently.

---

📢 News

• NowSecure: 3 years as OWASP MAS Advocate — #3253
• Guardsquare achieves MAS Advocate status by @cpholguera — #3285
• Safe App Standard v2.0 adoption update by @userdehghani — #3254
• New talk: OWASP AppSec US 2024 (San Francisco) by @sushi2k — #3143
• New talk: OWASP AppSec EU 2025 by @sushi2k — #3345

---

🏛️ Major Structural Milestones

• MASTG v2 exits beta — removed beta status, deprecated legacy PDF format by @cpholguera — #3295
• MASWE temporarily extracted to OWASP/maswe as a dedicated repo, then re-integrated into MASTG by @cpholguera — #3395, #3398, #3400
• MAS Website extracted to OWASP/mas-website by @cpholguera — #3426, #3459
• MAS-P Privacy profile added, covering all MASVS-PRIVACY test cases by @Diolor — #3496
• MAS Testing Profiles applied to all v2 test cases and documented by @cpholguera — #3315, #3483

---

🐛 MASWE — MAS Weaknesses

New Weaknesses

• [MASWE-0020] Weak Encryption (by @appknox) by @sk3l10x1ng — #2910
• [MASWE-0023] Weak Padding by @jmariasantosdekra — #2922
• [MASWE-0047–0052] New weaknesses by @cpholguera — [#2919](https://github.co

v1.8.0 Release Notes

This release spans October 2023 – December 2024 and lays the groundwork for MASTG v2: new component types (MASWE Weaknesses, MASTG Demos, MASTG Best Practices), a cross-reference system linking all MAS components, the first wave of v1→v2 test ports (by Guardsquare), and MASVS v2.1.0 with the new MASVS-PRIVACY category.

The period opened with a major standards milestone: the MASVS-PRIVACY proposal in October 2023, introducing four new privacy controls (MASVS-PRIVACY-1 through -4) and the MAS-P profile for holistic privacy assessment alongside security. After community review, MASVS v2.1.0 shipped in January 2024 with MASVS-PRIVACY formally included and CycloneDX/SBOM support added, enabling easier integration into DevSecOps pipelines.

External adoption continued to grow: in February 2024, the Cyber Security Agency of Singapore (CSA) published its "Safe App Standard", a national guideline for mobile app security based directly on the OWASP MASVS, covering MASVS-AUTH, MASVS-STORAGE, and MASVS-RESILIENCE.

The architectural highlight of the release came in July 2024 with the public introduction of MASWE — the Mobile App Security Weakness Enumeration. MASWE fills the gap between the high-level MASVS controls and the low-level MASTG tests, completing the full chain: MASVS control → MASWE weakness → MASTG test → MASTG demo. This release also introduced the MAS Test Apps (Android and iOS), purpose-built skeleton apps that embed code samples directly to make every demo reproducible and verifiable on a real device.

🏔️ OWASP Project Summit 2024

In November 2024, we hosted the OWASP Project Summit, where NowSecure led the mobile app security track. This five-day event brought together experts from various companies to discuss the future of mobile security, share insights, and collaborate on innovative solutions. During the summit, approximately 40 pull requests were created, and countless discussions were held. Special thanks to Jeroen Beckers (@TheDauntless) and especially to Guardsquare, who contributed the majority of PRs: Dennis Titze (@titze), Jan Seredynski (@serek8), Nuno Antunes (@nmsa), and Pascal Jungblut (@pascalj), with reviews by @cpholguera and @TheDauntless. This was a key moment for the MASTG v2 porting effort.

---

📢 News

• MASVS v2.1.0 released including the new MASVS-PRIVACY category by @cpholguera — #2513
• CSA publishes a standard for Secure Transactions via Mobile Applications based on the OWASP MASVS by @cpholguera — #2562
• Mobile Application Risk Scoring Q&A by @cpholguera — #2479
• New talks: OWASP AppSec US 2023 — #2466, #2469; 2024 H1 by @cpholguera — #2651
• New blog posts by @cpholguera — #2845, #2846

---

🆕 New MASTG v2 Components

🐛 MASWE — MAS Weaknesses

Note: MASWE started in this repo but was later moved to OWASP/maswe as a separate project (see v1.9.0 release notes).

A new component type linking MASVS controls to testable weaknesses. First entries added this release:

• [MASWE-0001, MASWE-0027, MASWE-0108] Initial MAS Weaknesses preview by @cpholguera — #2518
• [MASWE-0004] Sensitive Data Not Excluded From Backup by @serek8 — #2866
• [MASWE-0005] Sensitive Data Hardcoded in t

MASTG Refactor Part 2: Techniques, Tools & Reference Apps: This release introduces the second phase of the MASTG (Mobile Application Security Testing Guide) refactor. These changes aim to enhance the usability and accessibility of the MASTG.

The primary focus of this new refactor is the reorganization of the MASTG content into different components, each housed in its dedicated section/folder and existing now as individual pages in our website (markdown files with metadata/frontmatter in GitHub):

NOTE: You may find broken links on the website and in the PDF/eBook. This is a consequence of these massive changes and we expect to be able to fix them soon.

• Tests:

  • Website: Tests section.
  • GitHub: tests/ folder.
  • Identified by IDs in the format MASTG-TEST-XXXX.
  • Includes all tests originally in:
    • 0x05d/0x06d-Testing-Data-Storage.md
    • 0x05e/0x06e-Testing-Cryptography.md
    • 0x05f/0x06f-Testing-Local-Authentication.md
    • 0x05g/0x06g-Testing-Network-Communication.md
    • 0x05h/0x06h-Testing-Platform-Interaction.md
    • 0x05i/0x06i-Testing-Code-Quality-and-Build-Settings.md
    • 0x05j/0x06j-Testing-Resiliency-Against-Reverse-Engineering.md
  • :warning: IMPORTANT (TODO): These tests are still the original MASTG v1.6.0 tests. We will progressively split them into smaller tests, the so-called "atomic tests" in MASTG v2 and assign the new MAS profiles accordingly.

• Techniques:

  • Website: Techniques section.
  • GitHub: techniques/ folder.
  • Identified by IDs in the format MASTG-TECH-XXXX.
  • Includes all techniques originally in:
    • 0x05b/0x06b-Basic-Security_Testing.md
    • 0x05c/0x06c-Reverse-Engineering-and-Tampering.md

• Tools:

  • Website: Tools section.
  • GitHub: tools/ folder.
  • Identified by IDs in the format MASTG-TOOL-XXXX.
  • Includes all tools from:
    • 0x08a-Testing-Tools.md

• Apps:

  • Website: Apps section.
  • GitHub: apps/ folder.
  • Identified by IDs in the format MASTG-APP-XXXX.
  • Includes all apps from:
    • 0x08b-Reference-Apps.md

We hope that the revamped structure enables you to navigate the MASTG more efficiently and access the information you need with ease. See below for a detailed list of changes.

We'd like to thank all of our loyal contributors and welcome our new contributors.

Special thanks to NowSecure for their consistent high-impact contributions to the project, especially for this new OWASP MASTG refactoring phase and for continuing spreading the word about the OWASP MAS project.

We'd also like to thank our new MAS Advocate applicants for waiting patiently while we get everything ready behind the scenes for them to help us efficiently.

💙 Thanks to Zimperium for their generous donation!

Carlos Holguera, Sven Schleier and Jeroen Beckers - OWASP MAS project

NOTE: the OWASP MASTG v1.7.0 relies on the latest MASVS v2.0.0

Help us improve! [questions](https://github.com/OWASP/owasp-mastg/discussions

Following up on the OWASP MASVS v2.0.0 Release we're excited to announce the release of the new OWASP MASTG version v1.6.0. This update includes a range of new features, including the first phase of the MASTG refactoring, MASVS color-coding, upgraded MAS Checklists (for OWASP MASVS v2.0.0 + MASTG v1.6.0), and much more. See below for a detailed list of changes.

We'd like to thank all of our loyal contributors and welcome our new contributors.

Special thanks to NowSecure for their consistent high-impact contributions to the project, especially for the MASVS refactoring, the OWASP MASTG refactoring, the OWASP MAS website and this MASTG v1.6.0 release and for continuing spreading the word about the OWASP MAS project.

💙 Thanks to dvuln, eShard, OHRUS and devoteam Cyber Trust for their generous donations!

Carlos Holguera, Sven Schleier and Jeroen Beckers - OWASP MAS project

NOTE: the OWASP MASTG v1.6.0 relies on the latest MASVS v2.0.0

Help us improve! questions | ideas | contact

What's Changed

📢 News

Introducing the MASVS v2 Colors

We're bringing official colors to the MASVS! The new colors will be used across the MASVS v2.0.0 and MASTG v2.0.0 to help users quickly identify the different control groups. We've also revamped certain areas of our website to make them more readable and easier to navigate as well as to prepare for what's coming with the MASTSG v2.0.0 (keyword: "atomic tests").

MASVS

In the MASVS home page, the new colors will be used to highlight the different control groups.

The individual controls will also be color-coded to help users quickly identify the different control groups. We've also redesigned the control pages to make them more readable and easier to navigate.

MASTG

Now, when you navigate to the MASTG tests, you'll see that they are categorized by platform (Android/iOS) as well as by MASVS category, also using our new colors in the sidebar. The colors will also be used to highlight the different control groups in the test description.

Each test now contains a header section indicating the platform, the MASVS v1.5.0 controls, and the MASVS v2.0.0 controls.

We've also introduced a new section called "Resources" which is automatically generated using the inline links within the MASTG pages and serve as a quick reference to the most important resources for each test.

NOTE: The MASTG tests themselves haven't changed yet, we're still working on the refactoring. For now we've simply split the tests into individual pages to make them easier to navigate and reference. This will facilitate the work on the refactoring and the introduction of the new atomic tests.

MAS Checklist

The MAS Checklist pages and the MAS checklist itself have also been updated to use the new colors to highlight the different