The Mobile App Security Checklist (2026)
104 controls for Android and iOS teams, mapped to OWASP MASVS v2 and the 2024 Mobile Top 10, with a how-to-verify tip for every item. Free PDF download.
Most mobile breaches are not clever zero-days. They are hardcoded keys, missing server-side checks, exposed components and debug leftovers that shipped to production. This free checklist turns OWASP MASVS v2 and the 2024 OWASP Mobile Top 10 into a plain list your team can work through in a sprint.
Download the Mobile App Security Checklist (PDF)
What's inside
- 104 controls for Android and iOS, each tagged Critical, High or Medium and marked Android, iOS or Both
- A "how to verify" line for every item, so a control only counts once you have proven it on a real build
- All eight MASVS v2 groups: storage, cryptography, authentication, network, platform, code quality, resilience and privacy
- Two sections the standards under-weight: backend and API security (OWASP API Top 10 2023), and supply chain, signing and CI/CD
- Store rules for 2026: Google Play target API and 16 KB page size, Apple privacy manifests and required-reason APIs
- A 10-minute self-audit you can run with free tools
- A pre-release Go / No-Go gate and a first-24-hours incident playbook
- A scorecard: any open Critical item caps your rating at Exposed, whatever your total
How to use it
Pick your platform and skip what does not apply. Fix every Critical item before you ship. Run the Go / No-Go gate before each release, and the full list twice a year.
This checklist is a practical baseline aligned with OWASP MASVS and the Mobile Top 10. It is not a certification and does not replace a penetration test.
Want it checked automatically?
Many of these items can be found in the app binary itself: hardcoded secrets, exported components, cleartext traffic, weak crypto, debuggable builds. GoMobSec scans your APK or IPA for them and maps every finding to its MASVS control, with the file and line. Scan your app free — 3 scans a month, no credit card.