Attestation & Hardcoded Secrets (Android+ iOS): Best Practises, Know, Tests, Demos - #3756

Open

Diolor wants to merge 59 commits into

OWASP:masterfrom

Diolor:key-attestation-best-practice

Commits on May 14, 2026

Move MASTG-KNOW-0044 from MASVS-STORAGE to MASVS-RESILIENCE
Diolor
committed
d31306f
Clean BE/KW regarding attestation
Diolor
committed
dd0cc30
Clean BE/KW regarding attestation
Diolor
committed
d37cdac
Enhance key attestation documentation with detailed explanations and code examples
Diolor
committed
4b197af
WIP attestation
Diolor
committed
19c80a6
Enhance Android Key Attestation
Diolor
committed
a165a22
Enhance Android Key Attestation
Diolor
committed
87a920e
Enhance Android Key Attestation
Diolor
committed
057773b
Make descriptive content
Diolor
committed
b2d567b
grammar
Diolor
committed
02ac39a
Fix irelevant info
Diolor
committed
bb98920
Add pointer
Diolor
committed
b58d198
Indents
Diolor
committed
02e6af6
Lint + fix prescriptive
Diolor
committed
544ea58
Move Integrity Signals to BEST
Diolor
committed
6007387
Update knowledge/android/MASVS-STORAGE/MASTG-KNOW-0045.md

Diolor
and
Copilot
committed
76546c3
Use existing placeholders
Diolor
committed
aed967d

Commits on May 17, 2026

Add tests
Diolor
committed
0ef2111
Rename tests
Diolor
committed
bdbf5ce

Commits on May 19, 2026

Update best practices for Android Key Attestation and Play Integrity API
Diolor
committed
3f99519
Create the test
Diolor
committed
a62be1d
Add demo
Diolor
committed
d3364c4

Commits on May 20, 2026

Minor changes on demo
Diolor
committed
c428782
Cleanup Google Integrity API
Diolor
committed
5801a63
Add App Check and App/Device Attest for iOS
Diolor
committed
f983501
Rename BP
Diolor
committed
8881bcc
Lint
Diolor
committed
591fdb7
Add best practice guidelines for mitigating risks of hardcoded API keys
Diolor
committed
597ce89

Commits on Jun 14, 2026

Use placeholder names
Diolor
committed
efeddb7
Merge branch 'master' into key-attestation-best-practice
Diolor
committed
54a0075
Revert placeholder
Diolor
committed
51ba825
Revert placeholder
Diolor
committed
7a4504c
Use KNOW-0044
Diolor
committed
ad572c5
Fix temp ids
Diolor
committed
b6578de
Merge branch 'master' into key-attestation-best-practice
Diolor
authored
989879e
Revert
Diolor
committed
efcb468
Restore fix_ids.py #3869 logic accidentally over-reverted

Diolor
and
claude
committed
bcc6696

Commits on Jun 20, 2026

Add iOS App Attest test (MASTG-TEST-0x01)

Diolor
and
claude
committed
9ba815c
Renumber attestation tests: Android 0x01, iOS 0x02

Diolor
and
claude
committed
667fcfb
Add placeholder iOS App Attest demo (MASTG-DEMO-0x02)

Diolor
and
claude
committed
e954d30

Commits on Aug 16, 2026