Static analysis

MAST combines several static engines over the unpacked artifact (and the source repo when available). Everything below runs offline.

Native SAST

Line-anchored source analysis across Kotlin, Java, Swift and Objective-C (.kt .java .swift .m .mm); comment lines are skipped. Representative rules:

Android (Kotlin / Java)

Issue	CWE	Severity
Empty checkServerTrusted (TLS trust-all)	CWE-295	Critical
Allow-all hostname verifier	CWE-295	High
addJavascriptInterface / WebView universal or file access	CWE-749	High
ECB / DES / RC4 / Blowfish cipher	CWE-327	High
MD5 / SHA-1	CWE-328	Medium
java.util.Random for security	CWE-330	Medium
MODE_WORLD_READABLE / WRITEABLE	CWE-276	High
SQL injection via rawQuery / execSQL concatenation	CWE-89	High
Runtime.exec / ProcessBuilder	CWE-78	Medium
Secret written to Log.*	CWE-532	Medium

iOS (Swift / Obj-C)

Issue	CWE	Severity
TLS trust bypass (performDefaultHandling, SecTrustSetExceptions, ...)	CWE-295	High
Secret in UserDefaults	CWE-312	High
UIWebView (deprecated)	CWE-749	Medium
CC_MD5 / CC_SHA1	CWE-328	Medium
Secret in NSLog / print	CWE-532	Low

Flutter / Dart

Findings from the Dart engine fold into the mobile view: dart-* rule findings plus tree-sitter taint results (TAINT-<cwe>-DART). Two Flutter-specific checks are worth calling out:

• Resilience (RASP) absence - a Flutter app with no root / jailbreak / tamper-detection package (freeRASP, flutter_jailbreak_detection, safe_device and similar) is flagged against MASVS-RESILIENCE (dart-no-rasp, CWE-919).
• Pub typosquat - a dependency one character away from a popular pub package is flagged (dart-typosquat, CWE-1357).

SCA - vulnerable libraries & dependencies

Three layers, all mapped to CWE-1104 (use of an unmaintained / vulnerable component):

1. Native libraries - version strings embedded in bundled binaries (.so, dylibs) are matched against known-vulnerable builds: OpenSSL (CVE-2016-2107, CVE-2021-3711, CVE-2022-3602), SQLite < 3.39 (CVE-2020-13871), libpng 1.0-1.5 (CVE-2019-7317).
2. Native dependency manifests - build.gradle(.kts), Podfile.lock, Package.resolved, gradle.lockfile (Gradle / CocoaPods / Swift PM) are matched against known-bad versions of okhttp, gson, jackson-databind, Alamofire and AFNetworking.
3. Pub / Dart - Flutter dependency CVEs are handled by the shared SCA engine.

Manifest & config

• AndroidManifest.xml - compiled binary XML (AXML) is decoded (via pyaxmlparser) and evaluated for the usual misconfigurations - exported components, debuggable, cleartext traffic - through the shared IaC engine. When AXML cannot be decoded, a best-effort string heuristic is used.
• Info.plist - App Transport Security - NSAllowsArbitraryLoads (high) and NSAllowsArbitraryLoadsInWebContent (medium), both CWE-319.
• Firebase - Realtime Database hosts, project ids and storage buckets are extracted from the artifact; when a scan is authorised, a read-only open-rules probe checks whether the database is world-readable.
• Permissions - Android permissions from the decoded manifest and iOS permissions mapped from Info.plist usage-description keys are surfaced and feed the privacy analysis.

Secrets

Every text member is run through the platform's secrets engine, so API keys, tokens and credentials shipped inside the app are caught alongside the mobile- specific findings.