Skip to content

Customize OWASP MASVS Default Findings

Create, edit, and safely use reusable OWASP MASVS findings in your local Default Findings Engine.

Repeated findings are useful only when they stay accurate. The OWASP MASVS Default Findings Engine lets an authorized team leader or admin save a reusable starting point against a canonical mobile security control. It reduces repeated typing while leaving the actual observation, evidence, scope, and validation inside each project finding.

What this solves

Mobile assessments repeatedly find insecure local storage, weak certificate validation, exported components, unsafe deep links, sensitive logs, backup exposure, and missing reauthentication. Scanner text may describe a file or manifest property without explaining whether the behavior is reachable or harmful in the tested build.

Before you begin

  • Sign in as a team leader or team admin with access to the local engine.
  • Confirm that OWASP MASVS is the correct Library for the work.
  • Choose a recurring issue pattern, not one client-specific finding.
  • Remove names, URLs, selectors, credentials, personal data, dates, and evidence from the reusable wording.
  • Keep the official OWASP Mobile Application Security Verification Standard (MASVS) scope and terminology available for reference.

Step-by-step

  1. Confirm the MASVS version, platforms, application build, and test environment.
  2. Locate the exact MASVS control in the local engine.
  3. Describe the reusable mobile security failure without naming a package, class, or client.
  4. Explain the expected protected outcome and likely user or business impact.
  5. Add remediation that can work across Android and iOS where appropriate.
  6. Record the real binary, device, OS, component, steps, and evidence in the project finding.

What the default saves

A local default can save the summary, description, remediation guidance, severity behavior, and canonical mobile security control mapping. When a reviewer selects it from New Finding, voiqq prefills those values. The new finding still starts Open with Pending validation and must be changed to match the real observation.

Good patterns to predefine

  • Sensitive information is stored in a location accessible outside the intended app boundary.
  • Certificate or hostname validation can be bypassed in the assessed network path.
  • An exported component accepts untrusted input without the required authorization.
  • A deep link exposes a token or permits an unintended navigation or action.
  • The application reveals sensitive values through logs, backups, notifications, or snapshots.

Check your result

  • Keep package names, classes, selectors, and secrets out of reusable defaults.
  • Do not assume a static alert is exploitable in the running app.
  • Separate Android-specific and iOS-specific behavior when necessary.
  • Map to the applicable MASVS control and preserve supporting references.
  • Validate against the corrected build.

Open the OWASP MASVS engine

Read the technical guide

voiqq uses the official OWASP ASVS 5.0.0 catalogue: 345 individual verification requirements across 17 chapters. A finding can be linked to the relevant requirement, while the report summarizes coverage by chapter instead of dumping every requirement into the report.

How to customize OWASP MASVS default findings | voiqq