Daily upstream checks
Every framework, vulnerability feed and store policy APPCHK depends on is checked for new versions every day. A new version is imported, validated and reviewed before it reaches a single report.
Standards
Standards, mapped to evidence.
A finding is only useful if you can defend it. In APPCHK every check is mapped to the standards your auditors, customers and app stores use, and to the exact place in your build that triggered it.
The chain
Control, weakness, test, evidence.
OWASP's mobile standards connect in one line: a MASVS control states the requirement, a MASWE weakness names what goes wrong, a MASTG test describes how to check it. APPCHK adds the last link: the evidence in your app.
Control · MASVS
MASVS-RESILIENCE-4Anti-dynamic analysisWeakness · MASWE
MASWE-0063Debug mechanisms not disabledTest · MASTG
MASTG-TEST-0226Debuggable flag in the manifestEvidence · APPCHK
android:debuggable="true"AndroidManifest.xmlEach finding also carries its CWE (here CWE-489, active debug code) and, where it fits, an OWASP Mobile Top 10 category.
Coverage
Every framework, pinned to an exact version.
| Framework | Version | What APPCHK uses it for |
|---|---|---|
| OWASP MASVS | v2.1.0 | The 24 security controls every finding is measured against |
| OWASP MASWE | v1.0.0 | The 78 weaknesses that name what went wrong |
| OWASP MASTG | v2.0.0 | 200 current tests, with techniques, tools and best practices for remediation |
| MITRE CWE | 4.20 | 969 weaknesses, including the view for mobile applications |
| CVE · NVD · OSV | Daily | Known vulnerabilities in the libraries inside your app |
| FIRST CVSS | 3.1 and 4.0 | Severity of known vulnerabilities, as published with the advisory |
| OWASP Mobile Top 10 | 2024 | The ten risk categories executives and customers ask about |
| NIST SSDF | 1.1 | Secure development practices and tasks, for compliance reporting |
| MITRE ATT&CK for Mobile | v19.2 | Adversary tactics and techniques behind malware indicators |
| PCI DSS | v4.0.1 | Requirement references for payment apps |
Kept current
Checked every day. Changed only on purpose.
Cross-checked catalogs
The catalogs are validated against each other: nearly 7,000 links between frameworks must resolve, or the update stops. Mappings never drift silently.
Why pinning matters
One renumbering, many wrong reports.
In August 2026 OWASP released MASWE v1.0.0 and renumbered every weakness. The MASTG tests published in June still cite the old numbers, and some old numbers now belong to different weaknesses. The debuggable-flag test cites MASWE-0067, which in v1.0.0 is a privacy weakness; the right one is MASWE-0063. APPCHK translates every former ID through OWASP's own mapping, so your reports cite the weakness that was meant.