I went to OWASP MAScon in Vienna, a OWASP event that had a mobile app security track, with one of my startup partners and a friend, Sergio. We wanted to go with vulnit as sponsors and have a stand, but all the stands were already taken, so we went as visitors.
We wanted to meet the people behind the OWASP MASTG, the project Sergio and I had been contributing to over the last months. Carlos, one of the people leading the OWASP MAS project told us that he was organizing such event and that we could go as visitors.
A surprise on the first day
What we did not expect was that, on the first day, vulnit was announced as a MAS Advocate. We had just arrived, and this was a very nice surprise for us.
OWASP also published a post about vulnit becoming a MAS Advocate, where they mention me and Sergio García, and explain the contributions and reviews we had been doing.
My work on the MASTG
From around December 2025 to May 2026, I worked on the port from MASTG v1 to v2, writing PRs and reviewing other people’s work.
The MASTG v2.0.0 release post also mentions me, along the contributors, and the other people who worked on it. It is nice to see my name there after all these months working on the project.
I wanted to leave my contributions and reviews here, so they are all in one place. ### My contributions
- #3563: Port MASTG-TEST-0069 to v2: iOS App Permissions and Entitlements.
- #3607: Port MASTG-TEST-0049: Testing Emulator Detection.
- #3737: Port MASTG-TEST-0092: Testing Simulator Checks.
- #3770: Port MASTG-TEST-0051: Testing Obfuscation for Android.
- #3778: Port MASTG-TEST-0057 to v2: iOS Sensitive Data Exposed in Text Input Fields.
- #3809: Review Fixes for MASTG-DEMO-0x57 and MASTG-BEST-0x41.
- #3823: Port MASTG-TEST-0091 to v2: iOS Reverse Engineering Tools Detection.
- #3827: Align iOS Runtime Hook Detection Test.
- #3846: Review of PR #3563.
- #3861: Review of PR #3842.
- #3862: Additional Review of PR #3842.
- #3881: Enhancements for Tests 0372-0375 and Demos 0136-0141.
- #3883: Review of Implicit Intents Content.
- #3901: Port MASTG-TEST-0093: Testing Obfuscation for iOS.
My reviews
- #3328: Testing Local Storage for Input Validation.
- #3534: Sensitive Data Stored Unencrypted via SQLite.
- #3540: Sensitive Data Stored Unencrypted via DataStore.
- #3541: Sensitive Data Stored Unencrypted via Room.
- #3563: iOS App Permissions and Entitlements.
- #3607: Android Emulator Detection.
- #3672: Testing Object Persistence for Android.
- #3692: Testing Runtime Integrity Checks for Android.
- #3706: MASTG-KNOW-0036 and MASTG-TEST-0287.
- #3737: Testing Simulator Checks for iOS.
- #3770: Testing Obfuscation for Android.
- #3789: Static and Dynamic Library Techniques for Android and iOS.
- #3827: iOS Runtime Hook Detection.
- #3846: Review of PR #3563.
- #3862: Review of PR #3842.
The work started with the port from v1 to v2, but we are now adding new things to v2 too. I will keep contributing to the MASTG personally, and while I am at vulnit, also as part of our work as a MAS Advocate.
Meeting the people behind it
On a personal level, I am also taking very good memories from this trip. Carlos introduced us to the people contributing to the MASTG, the MAS Task Force (we are part of it now), and to his team at NowSecure.
I got to meet people whose work I have looked up to, like Sergi Àlvarez, known as Pancake, and Ole André Vadla Ravnås, the creator of Frida. We all had a dinner together.
We had a really good time. To be honest, I did not expect to get to know them like this, or to feel so comfortable with people whose work I have followed.
Overall, it was a very good experience. I went there to meet the people behind a project I was already contributing to, and came back with people I want to keep talking to. We are all in this mobile security world, so I hope we meet again soon.