The OWASP Mobile Application Security Verification Standard provides a security model and control baseline for mobile applications. The voiqq system library uses canonical MASVS 2.1 control records so projects can map findings consistently across Android and iOS work.
Standards and scope
MASVS control groups cover storage, cryptography, authentication and authorization, network communication, platform interaction, code quality, resilience, and privacy. The selected project metrics and actual application context determine which controls and test depth are relevant.
- MASVS controls describe security properties and should be paired with suitable test procedures.
- Platform-specific implementation details belong in evidence and affected-component fields, not in the control identifier.
- MobSF can supply useful static and dynamic evidence but cannot establish every MASVS conclusion.
- Imported control aliases are matched deterministically where possible and left reviewable when ambiguous.
- Validation and retest history preserve the professional conclusion after remediation.
Who this is for
- Students and mobile-security training programs learning a recognized control model.
- Professional Android and iOS assessors producing consistent reports.
- Engineering teams using MASVS for design, development, and release assurance.
- Agencies, public institutions, and regulated organizations reviewing mobile product risk.
What voiqq provides
- Canonical MASVS identifiers, control groups, descriptions, and reference context.
- Project fields for platform, build, component, evidence, impact, remediation, and retest.
- Accurate spreadsheet and MobSF candidate mapping without forging missing source data.
- Assignments, status, validation, comments, evidence, and change history.
- MASVS-aligned assessment snapshots from reviewed project records.
A practical workflow
- Choose the app platform, version, build, environment, and authorized scope.
- Select applicable controls and test procedures based on risk and engagement goals.
- Map each validated result to the most specific control supported by evidence.
- Coordinate remediation and retest the exact affected build or successor build.
- Review coverage and limitations before exporting the assessment.
Put the framework into practice
The MASVS library supplies the common control language; voiqq adds the project, evidence, collaboration, remediation, validation, and reporting workflow around it.
Read the OWASP MASVS project page
voiqq uses the official OWASP ASVS 5.0.0 catalogue: 345 individual verification requirements across 17 chapters. A finding can be linked to the relevant requirement, while the report summarizes coverage by chapter instead of dumping every requirement into the report.