masaudit

A free mobile security scanner that scales its advice to your app's risk.

masaudit reads the source code of your Android, iOS, React Native, Kotlin Multiplatform, or Flutter app, and finds security weaknesses before you ship. It first asks what kind of app you're building, then sorts every finding into fix before release, fix soon, or not needed for your app, and says why. masaudit tells a banking app to pin certificates, and never tells a news app to.

masaudit needs no AI, no account, and no network connection after the first download.

Documentation · Getting started · Rules

Quick start

Use masaudit on its own, or with an AI assistant. The scan, the report, and every fix work without AI.

Without AI

You need Python 3.9 or later. In your project's root folder, run one of these:

uvx masaudit .                       # if you have uv: https://docs.astral.sh/uv/
pipx run masaudit .                  # if you have pipx: https://pipx.pypa.io/
python3 ~/Downloads/masaudit.pyz .   # no installer: one file, works offline

For the last line, first download masaudit.pyz from the latest release to your Downloads folder. On Windows, run py $HOME\Downloads\masaudit.pyz . in PowerShell. Install and upgrade lists every way to run it.

masaudit asks one question, "What kind of app is this?", reads your project without running it, and writes SECURITY-AUDIT.md with the top fixes first. Getting started walks you through your first fix.

With an AI assistant

In Claude Code:

/plugin marketplace add hossam9k/masaudit
/plugin install masaudit@masaudit
/masaudit:scan

Codex, GitHub Copilot, Cursor, Gemini CLI, and other Agent Skills tools can use the same skill, and any chat assistant can use the report's fix plan. See Use masaudit with an AI assistant.

See it on a real app

The repository ships a deliberately insecure demo app, Acme Wallet. Scanned as a news app, the terminal shows (trimmed):

$ uvx masaudit examples/acme-wallet --app-type news
Profile:   content (News, video, music, reading, or learning); MAS-L1+P; from --app-type
Clue:      Found a payment SDK (Stripe) in android/app/build.gradle.kts - ecommerce may fit

Fix before release: 9   Fix soon: 12   Notes: 0   Not needed: 18   Accepted: 0

Top fixes:
  1. [critical] Release build is debuggable (AND-002) - android/app/build.gradle.kts:17
  2. [critical] WebView ignores TLS certificate errors (AND-004) - .../WalletApi.kt:40
  3. [critical] pull_request_target workflow checks out the pull request's code (CI-003) - ...

The same code gets different advice under each app type:

Each finding tells you why it matters, how to fix it (often with paste-ready code), how to verify the fix, how long it takes, its OWASP IDs, and the section of a free book that explains it.

What it checks

207 rules: 70 Android, 47 iOS, 20 React Native, 48 cross-platform code, 8 Flutter, 8 CI and supply chain, 6 Kotlin Multiplatform. Together they cover 52 of the 78 weaknesses in OWASP's MASWE catalog and cite 140 OWASP MASTG tests.

• Network: cleartext (including raw sockets and old targetSdk defaults), ATS exceptions, user CAs, TLS bypasses, missing host-name checks, old TLS versions, gRPC plaintext, and pinning where the app type needs it.
• Storage: tokens in plain preferences, UserDefaults, files, and databases, Keychain classes, backups and device transfer, shared and world-readable files, keyboard caching of sensitive fields.
• Crypto: hardcoded keys and credential checks, ECB, CBC without a MAC, fixed IVs and salts, broken ciphers, small keys, weak PBKDF2, tokens from the clock.
• Platform: exported components, intent redirection, deep links, FileProvider, Dirty Stream, Zip Slip, SQL and HTML injection, WebView risks, native buffer overflows, screenshot and overlay protection.
• Auth: biometrics not bound to a key, passcode fallback for sensitive actions, keys that survive new enrollments.
• Privacy: sensitive permissions, hardware identifiers, IDFA without App Tracking Transparency, privacy manifests, tracking domains.
• Build and CI: debuggable releases, debug tools in release, R8 keep rules, unpinned actions, persisted tokens, script injection, committed signing keys.
• Resilience, for banking, identity, loyalty, and game apps: Play Integrity, App Attest, and root, debugger, emulator, and hooking detection.
• React Native and Expo: tokens in AsyncStorage or unencrypted MMKV, secrets bundled through .env or EXPO_PUBLIC_ variables, WebView file access and open origins, deep-link data reaching openURL or a WebView, eval, unsigned over-the-air updates, Hermes turned off, source maps and console output in release builds, and Expo config in app.json. The JavaScript and TypeScript are read along with the native android/ and ios/ folders, and a managed Expo app with no native folders gets the Android and iOS checks from its config.

Guides by task

In GitHub Actions, the step looks like this; the CI guide has the complete workflow:

- uses: hossam9k/masaudit@<commit-sha> # v0.6.1
  with:
    app-type: banking
    fail-on: high

How accurate it is

The rules were measured on 19 open-source apps, including Signal, Bitwarden, Wikipedia, Nextcloud, DuckDuckGo, and Thunderbird. Reviewers who didn't write the rules opened every finding in shipping code (CI findings were sampled). The maintainers fixed every false alarm, added a test for it, and scanned the apps again.

• 79 rules fired on these apps; 78 are at 90% precision or better. The one below, IOS-012 (89%), is marked Check by hand. Rules that found nothing there are checked by their test fixtures.
• React Native, measured on 10 more apps (Mattermost, Rocket.Chat, Bluesky, Expensify, BlueWallet, MetaMask, and others): 57 of the 63 findings that 0.6.0 adds are real (90%). Four rules under 90% there are marked Check by hand.
• Finds 126 of 133 planted weaknesses in OWASP's MASTG demos, DIVA, InsecureBankv2, and DVIA-v2 that a source scanner can see (95%), and 21 of 28 in three deliberately vulnerable React Native apps (75%). The rules were tuned on these apps, so expect less on unseen code; the misses and the method are published.
• Fast on large code bases: the largest app, DuckDuckGo for Android (about 10,000 files), scans in about 5 seconds on a laptop, with no crashes on any of the 19.

Method and per-rule numbers: Accuracy and speed.

Limits and safety

• What it can't see: your server, runtime behavior, and business logic, which is where many breaches happen. Every report has a Residual risk section for that reason.
• Safe to run on any code: masaudit never builds or runs your code, makes no network calls (a test enforces it), sends no telemetry, and masks secrets in every output. Crafted files can't stall it.

How masaudit works explains both. To report a vulnerability, see SECURITY.md.

How it compares

MobSF also analyzes built APK and IPA files and runs the app for dynamic testing, which masaudit doesn't. Use both.

Documentation

The documentation home has every guide, the command-line and config file reference, and how masaudit works.

Contributing

False-positive reports are the most valuable contribution: a rule that raises false alarms gets ignored. Use the false-positive form. Adding a rule takes about 30 minutes; see CONTRIBUTING.md.

About

Built by Hossam Atef, a mobile engineer (Android, iOS, Kotlin Multiplatform), as the practical companion to his free book, Mobile Application Security: A Study Book for Engineers. Every rule traces to a section of the book, and the book records how each claim was verified.

The name is MAS + audit: it audits your app against OWASP MAS (Mobile Application Security), the standards behind its checks. masaudit is not an OWASP project; OWASP doesn't certify apps or endorse tools.

Licensing: code Apache-2.0, fix snippets MIT-0, explanations CC BY-SA 4.0. See LICENSING.md.

masaudit is free. If it saved you an audit, you can sponsor it.