Lesson 5.11: Capstone: reviewing a new app before release
Northwind's field technicians are getting a new app, Northwind Field 1.0.0, which shows each day's jobs with customers' names, phone numbers and addresses and collects their signatures. Before it goes to the managed store, you review it against everything in this course, in MASVS order: build and signing, manifest, secrets in the code, network configuration, storage on the device and logs. You record each finding with severity, evidence and fix, sort them, seal the report, and recommend whether the app can ship.
26 min
You will learn to
- Review an app end to end against MASVS
- Combine static analysis and device testing
- Record findings with severity, evidence and fix
- Seal a report with a hash
- Make a clear release recommendation
Key terms
- MASVS categories
- STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY.
- Static analysis
- Examining the app file without running it.
- Dynamic analysis
- Observing the running app: its files, logs and traffic.
- Release gate
- The condition an app must meet before it ships.
- Re-test
- Checking that fixes work before closing findings.
← Backups and recovery · All lessons · DHCP: how devices get their network settings →