Question 1

What is mobile application security testing (MAST)?

Accepted Answer

MAST is the practice of finding security vulnerabilities in mobile applications across their entire lifecycle – during development through source code analysis, and after publication through binary analysis of the shipped artifact. Unlike server-side testing, MAST has to account for things specific to mobile: insecure data storage on the device, hardcoded secrets inside the binary, weak cryptography, certificate pinning failures, exposed deeplinks, and platform-specific misconfigurations on iOS and Android.

Question 2

Do I need source code for mobile app security testing?

Accepted Answer

Not necessarily. DerScanner MAST works in two modes: source code analysis for apps you're building (Java, Kotlin, Swift, Objective-C, Dart/Flutter) and binary analysis for apps that already exist as IPA or APK files – including third-party apps where you'll never see the source. Most teams need both: source for the code your developers control, binary for everything else (vendors, contractors, post-build verification).

Question 3

Can you test apps already published in app stores?

Accepted Answer

Yes. Paste a Google Play link into DerScanner and it scans the published binary. This allows to check apps from acquired companies, third-party vendors, contractors who shipped without security review, or own production app to verify nothing regressed between staging and store.

Question 4

Does DerScanner require access to source code?

Accepted Answer

No. DerScanner runs binary analysis on compiled IPA and APK files, so you can test apps you don't own and apps where the source is unavailable. If you do have source, DerScanner uses it for deeper SAST coverage of Java, Kotlin, Swift, Objective-C, and Dart. The choice between source-based and binary-based scanning is yours, and most production AppSec programs use both.

Question 5

Is MAST better than penetration testing?

Accepted Answer

They solve different problems. MAST is automated, continuous, and runs on every build – it catches the known classes of vulnerabilities (OWASP Mobile Top 10, MASVS controls, hardcoded secrets, insecure storage) at the speed of CI/CD. Penetration testing is human, periodic, and creative – pentesters find business logic flaws, chained exploits, and edge cases that no scanner will catch. Replacing pentests with MAST leaves blind spots. Mature programs run both: MAST for coverage and speed, pentests for depth.

Question 6

What platforms does DerScanner support?

Accepted Answer

iOS and Android. Source code analysis covers Java and Kotlin for Android, Swift and Objective-C for iOS, and Dart for cross-platform Flutter apps. Binary analysis covers IPA and APK files regardless of how they were built.

Question 7

What compliance standards does DerScanner MAST cover?

Accepted Answer

DerScanner maps mobile findings to OWASP Mobile Top 10, OWASP MASVS, CWE, CWE/SANS Top 25, PCI DSS 4.0.1, or HIPAA, with audit-ready reports generated directly from scan results. For regulated industries – fintech, health, payments – this means the same scan that found the vulnerability produces the evidence your auditor needs.

Question 8

How do I integrate DerScanner MAST into my CI/CD pipeline?

Accepted Answer

DerScanner has native integrations with Jenkins, TeamCity, Azure DevOps, and GitLab CI. The typical setup: trigger a scan on every pull request or nightly build, fail the pipeline on findings above your severity threshold, and post results back to the developer through their existing tooling. Binary scans work the same way – point the pipeline at the IPA or APK produced by your build step.

Question 9

What is the OWASP Mobile Top 10?

Accepted Answer

The OWASP Mobile Top 10 is the industry-standard list of the most critical security risks for mobile applications, maintained by the Open Web Application Security Project. The current version was released in 2024 and covers risks specific to mobile: improper credential usage, inadequate supply chain security, insecure authentication and authorization, insufficient input/output validation, insecure communication, inadequate privacy controls, insufficient binary protections, security misconfiguration, insecure data storage, and insufficient cryptography. DerScanner tests against all ten and maps every finding to its corresponding category.

Question 10

What is the OWASP MASVS?

Accepted Answer

MASVS (Mobile Application Security Verification Standard) is OWASP's framework defining what a secure mobile app should do. It sets requirements across eight control areas: storage, cryptography, authentication, network communication, platform interaction, code quality, resilience against reverse engineering, and privacy. MASVS is the standard most MAST tools – including DerScanner – map their findings against, so teams can verify coverage and report against a recognized baseline rather than a vendor-specific checklist.

Mobile Application Security Testing (MAST) Tool

What Is Mobile
Application
Security Testing
(MAST)?

Why Your Team Needs DerScanner MAST

One Tool for Android and iOS

Scan With or Without Source Code

OWASP Mobile Top 10 and MASVS Ready

Keep Source Code on Your Infrastructure

Android & iOS

Android Security Testing

iOS Security Testing

How DerScanner MAST Works

Key DerScanner MAST Features

Static Analysis for Mobile Source Code

Binary Analysis for APK and IPA

OWASP MASVS & Mobile Top 10 Mapping

Compliance Support

Approved by industry leaders

Why Modern Organizations Need DerScanner MAST

Built on a Full-Cycle Platform

Mobile Languages Most Vendors Skip

Compliance Mapping That Stays Up To Date

On-Premise When You Need It

Frequently Asked Questions

Make Your Applications
Secure Today