Use the OWASP MASTG for an Android Test Plan

Separate the requirement from the procedure

MASVS describes security controls. MASTG helps investigate whether an application satisfies relevant expectations. A control such as protecting sensitive stored data may require several procedures across files, databases, backups and logs.

Do not assume that running a tool named in a guide means the whole control has been assessed. Tools collect evidence; the application's behavior determines the result.

Build a small test case record

Objective: identify sensitive data written during a controlled login
Build: package, version and SHA-256
Environment: device/OS, test account and backend
Preconditions: clean install; synthetic account data
Actions: login, use feature, logout
Evidence: redacted file/log observations
Result: pass, fail, not applicable or not tested
Limitations: unavailable flows or unsupported device state

This record is intentionally specific enough for a second reviewer to repeat. Avoid storing live tokens or personal data in the report itself.

Select tests by feature

A camera-only offline utility and an authenticated payment client have different surfaces. Inventory local persistence, WebViews, exported components, external communication, authentication and third-party SDKs before selecting procedures.

For a feature that is absent, document why a test is not applicable. For a feature that could not be exercised, mark it not tested. Those conclusions should not be conflated.

Track the reference you used

MASTG content evolves. Record the test title or identifier and the source revision or review date alongside your evidence. Older blog posts may reference reorganized test IDs; follow the current official resource rather than guessing that a renamed page means a control disappeared.

Turn results into engineering work

A useful issue includes the affected artifact, the observed behavior, the violated boundary and a retest condition. “MASTG failed” gives a developer little to act on. “The release build writes the synthetic session token to an exported diagnostic log” is concrete.

APKLint's OWASP review page can structure preliminary checks and link observations. It is not a substitute for the device, account and backend access required to carry out the selected tests.