Skip to content
Vybebat
Quick scan · self-check

Check your release in two minutes.

Answer ten questions about the app you plan to ship and see where it stands across the eight OWASP MASVS v2.1 groups. No signup. Your answers never leave this browser.

01 · Your app

Start with the listing.

Optional. Paste a Google Play or App Store link and we read the platform and app ID from the link itself. Nothing is fetched or sent.

02 · Ten questions

Answer what you know.

Not sure is a fair answer. It counts as unknown, never as covered. You can skip any question.

  1. 01Are tokens and personal data kept out of plain files, shared preferences and logs?

    MASVS-STORAGE For example, stored with the Android Keystore or the iOS Keychain.

  2. 02Are API keys and other secrets kept out of the app binary?

    MASVS-CRYPTO Anything shipped inside the app can be extracted from the release build.

  3. 03Does your backend, not the app, decide what each user can see and change?

    MASVS-AUTH A hidden button in the app is not access control.

  4. 04Do sessions end on sign-out and expire after a reasonable time?

    MASVS-AUTH Including the tokens the app keeps on the device.

  5. 05Does every connection use HTTPS, with no cleartext exceptions in the release build?

    MASVS-NETWORK Check the network security config or App Transport Security settings.

  6. 06Does the app pin certificates for its own backend, or at least keep strict default TLS validation?

    MASVS-NETWORK No custom trust managers and no disabled certificate checks.

  7. 07Are exported components, deep links and WebViews limited to what the app needs?

    MASVS-PLATFORM For example, no JavaScript bridges or file access the app does not use.

  8. 08Do you track third-party SDKs and libraries and update them when issues are published?

    MASVS-CODE A dependency lockfile makes this much easier to check.

  9. 09Is the release build signed for release with debugging disabled?

    MASVS-RESILIENCE On Android, debuggable is false in the release variant.

  10. 10Does the app collect only the data and permissions it needs, matching its store privacy labels?

    MASVS-PRIVACY Including what third-party SDKs collect.

0 of 10 answered. Unanswered questions count as unknown.