Android Application Security Posture Kit

Mobile apps are treated as trusted clients far more often than they should be, and platform review does not fix that. A 2025 study of over 156,000 shipped apps found 815,000 unique hardcoded secrets in app code, many tied to live production systems — and every one of them passed Play Protect. No platform-level control catches a hardcoded key. Only an actual security review does. A 2026 analysis of over 150,000 apps found critical CVEs in third-party components in roughly one Android app in nine.

Scored against OWASP's own standard. This kit assesses an Android app against the OWASP Mobile Application Security Verification Standard v2.0 and the current Mobile Top 10 — the two standards platform providers, certification bodies and standards institutes actually reference — with every hardening row carrying its MASVS control reference. It is a configuration and architecture posture assessment, not a penetration test.

The Android-specific bug class this kit names. Encryption without integrity verification — data encrypted but never authenticated, so an attacker who flips bits in the ciphertext changes the plaintext — is decades old and still widespread in 2026 analyses. Alongside it: sensitive data in SharedPreferences, keys generated outside the Keystore, exported components and deep links reachable by any app on the device, cleartext traffic allowed by configuration, and release builds that are still debuggable.

The fix takes weeks to land. A hardcoded-secret fix needs a new build, store review, and update adoption that can take months to reach most users. That asymmetry is why a pre-launch review matters more on mobile than on any server-side platform, and why file 03 exists.

What you get

01 Assessment Methodology (DOCX) — why platform review does not catch app-level bugs, MASVS v2.0 and the Mobile Top 10 as the backbone, the five modules, run order, cross-links and assumptions.

02 Identity & Access Review Workbook (XLSX) — Session Handling (every protected call re-validated server-side), Android Keystore Usage (key generation inside the Keystore, hardware-backing, user-authentication binding), Modern Auth Adoption (Credential Manager, passkeys, biometrics) and Permission & Storage Scope, rolling into one identity posture score.

03 Blast Radius Scoring Tool (XLSX) — the flagship module. Four surfaces plus detection — local data storage, hardcoded secrets & keys, exported components & deep links, network & binary protection — resolving to one score, a band on the same bands as the iOS kit, and a closure list ranked by risk-weighted points. Local storage and hardcoded secrets carry the highest weights, matching what bug-bounty programmes actually pay out on.

04 MASVS-Aligned Hardening Checklist (XLSX) — Storage & Crypto, Network & Auth, Platform Interaction, and Resilience / Code / Privacy, each row with its MASVS v2.0 reference, scored gap-to-target with a hardening percentage per family. Android 15's platform changes are noted as not substituting for app-level review.

05 Data Governance Review (DOCX) — what the app actually collects and where it is stored, third-party SDK data-sharing behaviour, backup and cloud-sync exposure, and whether the Play Console data-safety disclosure matches reality.

06 Detection Readiness Matrix (XLSX) — crash reports and whether they leak, Play Console vitals, tamper and repackaging signals, anomalous client API patterns, exported-component abuse and device compromise. A mobile app has no built-in audit log, so this module scores low by design and says so rather than padding itself to look complete.

07 Executive Summary Template (DOCX) — one page: the four module scores, top five findings, plain-language meaning, remediation timeline, and the note to run the iOS kit alongside if the product ships on both.

and01.json — scoring bands, surfaces, MASVS groups and the module map.

A worked example throughout. Kestrel Transit, a fictional Android-first ride-hailing app, with a session token sitting in plaintext SharedPreferences.

Where it sits. The iOS Application Security Posture Kit is the direct sibling — same backbone, same bands, iOS's controls swapped in — and the pair is cheaper than buying both. The GitHub / GitLab Security Posture Kit covers the pipeline that builds the app; the Vibe-Coded App Security Posture Kit covers an AI-built backend behind it. The IR Runbook Library is the response layer; hand file 07 to the Director's Cyber Oversight Kit.

Written against OWASP MASVS v2.0, the OWASP Mobile Top 10 (2024), Android 15 platform features and Play policies as of Q3 2026, all marked verify. MASVS references are mappings, not conformance claims. Not a penetration test or a SAST engagement. Scores are a prioritisation aid, not a certification, an audit opinion or an insurance-underwriting determination. Not legal advice.