MASA and Google Play's independent security review.

The "Independent security review" line in your Google Play Data safety section is not automatic.

It comes from the App Defense Alliance's Mobile App Security Assessment (MASA). An Authorized Lab assesses your app against the OWASP MASVS and its eight control groups and, if it passes, your app is listed and can show the Independent security review badge on Google Play. The certification is valid for one year.

You pick an assurance level that sets how deeply the lab validates the controls: AL1 or AL2.

vulnit is an OWASP MAS Advocate, not an Authorized Lab, so we do not run the official MASA assessment or issue the badge.

What we do is the MASVS assessment itself: the same standard and the same controls the badge is based on. You learn exactly where your app stands and fix the gaps, so you reach an Authorized Lab's MASA review ready, or hold a MASVS report to show customers when the badge is not the goal.

MASA has two assurance levels. They test the same MASVS controls; what changes is how deeply the Authorized Lab validates them, and so how much the badge is worth.

• AL1, verified self-assessment: the Authorized Lab runs an automated scan of your public app and you complete a developer questionnaire with evidence. Faster and cheaper, with lower assurance.
• AL2, lab evaluation: the Authorized Lab tests and validates every MASA requirement by hand, with remediation guidance and a retest. Higher assurance, the result that stands up to scrutiny.

We are not an Authorized Lab, so we do not issue either level. What we do is get you there, and the value differs by level:

• For AL1, we run a MASVS assessment so your app passes the automated scan and your self-declarations hold up.
• For AL2, we run the equivalent hands-on MASVS assessment, the same manual work AL2 demands, so you reach the lab ready instead of discovering gaps during the evaluation.

This is delivered as our OWASP MASVS assessment: a report with the result for each control of the agreed profile, evidence, how to fix every gap, an executive summary, and an optional retest. On request we provide a signed letter with the profile, version and result for your customers.

Tell us about your app and whether you are after the badge or the MASVS standard behind it. We reply within one business day to arrange a scoping call.