Skip to content

OWASP MASVS Default Findings Engine

Understand how reusable OWASP MASVS findings are mapped, inherited, customized, and used without changing existing project evidence.

The OWASP MASVS Default Findings Engine is a requirement-aware template layer for OWASP Mobile Application Security Verification Standard (MASVS). It helps a team define consistent starting language for recurring findings while the normal project remains the source of truth for scope, evidence, ownership, remediation progress, validation, and reports.

Library and standards scope

OWASP MASVS organizes mobile application security controls across storage, cryptography, authentication, network communication, platform interaction, code quality, resilience, and privacy. A useful finding also needs the tested platform, build, device state, affected app area, attack surface, and evidence.

Global, local, and project layers

  • Global defaults are standards-based templates published by voiqq platform owners for a system Library.
  • Local defaults belong to the signed-in workspace administrator and can override editable wording without changing the global source.
  • A project finding receives copied template values and then becomes an independent record.
  • Later global changes do not silently rewrite a local override or a finding already created in a project.
  • Status is Open and validation is Pending when the reusable default is applied, unless an authorized project workflow later changes them.

Fields and canonical mapping

Each template is owned by a canonical mobile security control in the OWASP MASVS Library. The reusable record contains a stable identifier, summary, description, remediation guidance, severity key, mapped values, source Library, and display order. The visible wording can be edited locally, while the background requirement identity continues to support filters, reports, imports, and New Finding suggestions.

Create or customize a default

  1. Confirm the MASVS version, platforms, application build, and test environment.
  2. Locate the exact MASVS control in the local engine.
  3. Describe the reusable mobile security failure without naming a package, class, or client.
  4. Explain the expected protected outcome and likely user or business impact.
  5. Add remediation that can work across Android and iOS where appropriate.
  6. Record the real binary, device, OS, component, steps, and evidence in the project finding.

Writing rules for reusable findings

Write the summary as a concise statement of the recurring failure. Use the description to explain the expected behavior, likely impact, or control concern in neutral language. Use remediation to describe the desired outcome rather than a patch tied to one framework or customer. Store actual results, reproduction steps, affected assets, evidence, people, dates, measurements, samples, and environment details in the project finding.

Suitable template subjects

  • Sensitive information is stored in a location accessible outside the intended app boundary.
  • Certificate or hostname validation can be bypassed in the assessed network path.
  • An exported component accepts untrusted input without the required authorization.
  • A deep link exposes a token or permits an unintended navigation or action.
  • The application reveals sensitive values through logs, backups, notifications, or snapshots.

Use a default in a project

Open New Finding inside a project configured with OWASP MASVS. Choose Template mode or select a prepared template after choosing the applicable mobile security control. voiqq prefills the reusable values. Review every field, add the real evidence and context, and save the finding. Comments, attachments, assignments, history, validation, sharing, exports, and reports then use the same normal project workflow.

Accuracy and safety checks

  • Keep package names, classes, selectors, and secrets out of reusable defaults.
  • Do not assume a static alert is exploitable in the running app.
  • Separate Android-specific and iOS-specific behavior when necessary.
  • Map to the applicable MASVS control and preserve supporting references.
  • Validate against the corrected build.

Review the standards source

Open the OWASP MASVS engine

Explore the Library guide

voiqq uses the official OWASP ASVS 5.0.0 catalogue: 345 individual verification requirements across 17 chapters. A finding can be linked to the relevant requirement, while the report summarizes coverage by chapter instead of dumping every requirement into the report.