Aligned to OWASP MASVS L1 (standard) and L2 (defence-in-depth) verification levels. Every category exploited manually with Frida, Objection, MobSF, and platform-native tooling.
M1Improper Credential Usage
Hardcoded API keys, tokens, and secrets extracted from the app binary. Static credentials shared across users or environments.
M2Inadequate Supply Chain Security
Vulnerabilities in third-party SDKs, outdated libraries, and compromised CI/CD pipelines that ship malicious code into your app.
M3Insecure Authentication / Authorization
Client-side-only auth checks, weak session tokens, missing role enforcement, JWT signature flaws, biometric bypass via Frida.
M4Insufficient Input/Output Validation
SQL injection in local databases, command injection through deep links, XSS in WebViews, intent redirection abuse.
M5Insecure Communication
Missing TLS, weak cipher suites, lack of certificate pinning, ability to intercept and modify traffic in transit.
M6Inadequate Privacy Controls
Excessive permissions, third-party tracker leakage, PII written to logs, GDPR Article 32 violations on device.
M7Insufficient Binary Protections
No anti-tampering, no obfuscation, easily reversed business logic, missing runtime application self-protection (RASP).
M8Security Misconfiguration
Debug flags shipped to production, exposed admin functions, allowBackup enabled on Android, weak iOS entitlements.
M9Insecure Data Storage
Credentials in SharedPreferences/Keychain in clear text, sensitive data in SQLite without encryption, screenshots cache PII.
M10Insufficient Cryptography
Custom crypto, weak key derivation, ECB mode encryption, hardcoded encryption keys, certificate validation flaws.
