A fix in the store does not protect users who never install it. Without a way to require an update, a vulnerable version can stay in use, and keep talking to your backend, for years.
- Have the backend publish a minimum supported app version, and have the app check it at launch and block or warn below it.
- Use the platform update flows where available, and reject requests from unsupported versions on the server too.
MASTG tests in the local projects
Neither local project runs a MASTG test for MASVS-CODE-2. The guides below explain the platform mechanisms, and the control’s page on mas.owasp.org links the MASTG tests and weaknesses OWASP maps to it.
Closest guides
These guides cover the nearest controls and techniques; use them with the references below.
Practice
- Keep an iOS app's storage, links and web bridge in bounds · Local project
- Repair an Android app's links, components, network policy and storage · Local project
Gaps on this site
No guide here covers enforcing app updates or a minimum supported app version.
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
Control statements are quoted from OWASP MASVS v2.1.0, licensed CC BY-SA 4.0; the rest is this site's summary. MASTG tests are those the iOS and Android projects here run, with their titles from mas.owasp.org. License.