Skip to main content

Privacy & standards

MAST does not just list findings - it maps them onto the mobile-security frameworks your auditors and app-store reviewers care about, and it tells you which trackers are watching your users.

MASVS posture​

Findings roll up into the OWASP MASVS seven control groups: STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE. A group fails if it has any finding; the number of passing groups produces a letter grade:

GradePassing groups
Aall 7
B5 or more
C3 or more
Dfewer than 3

Beyond pass / fail, each MASVS control carries a verification level - L1, L2 or R - and a representative MASTG test id (for example MASVS-STORAGE-1 → MASTG-TEST-0052). The MASVS strip on the page shows passed / total per level, so you can see how deep your coverage goes, not just whether a group passed.

Privacy & trackers​

The embedded-SDK catalog (around 28 known trackers) is matched against the artifact and grouped by category: advertising, analytics, crash, attribution, engagement, push. Each tracker carries a shares_pii flag.

  • One finding per detected tracker (CWE-359) - medium if it shares PII, otherwise low.
  • A combined "personal data reachable by embedded trackers" finding (high) is raised when the app both requests dangerous data (location, contacts, SMS, camera, microphone, ...) and embeds a PII-sharing tracker.

Dangerous permissions are mapped to the data category they expose, so the privacy picture is "which SDKs can reach which user data," not just a permission dump.

Threat & prioritisation mapping​

  • MITRE ATT&CK Mobile - each finding's CWE is mapped to a technique and tactic (for example insecure TLS → T1638 Adversary-in-the-Middle, hardcoded credentials → T1552, insecure data storage → T1409). Permission-based findings fall back to data-capture techniques (location, protected user data, audio / video capture).
  • SSVC - the CISA deployer decision tree (Act / Attend / Track* / Track) ranks each finding from its severity, internet exposure, KEV membership and EPSS score, with a roll-up count per decision.
  • Compliance - findings roll up against PCI-DSS, GDPR, HIPAA and MASVS control sets.

Every finding on the static-analysis list is stamped with its ATT&CK technique and SSVC decision inline, so the highest-priority mobile risks are obvious at a glance.