About Android Security Masterclass
The OWASP Android Security Masterclass is a premier, hands-on security engineering and training laboratory designed for Android developers, penetration testers, and application security architects.
Unlike legacy educational vulnerable applications built on outdated Java and monolithic architectures, this project introduces a Hyper-Modular Mirror Architecture built entirely with modern Kotlin, Jetpack Compose, and Material 3, mapped 1:1 to the OWASP Mobile Application Security Verification Standard (MASVS v2.0) and Mobile App Security Weakness Enumeration (MASWE).
The 3-Dimensional Mirror Architecture
Every vulnerability in this masterclass is demonstrated through three synchronized application layers:
app-vulnerable (Offensive Lab): An interactive vulnerable environment demonstrating real-world coding anti-patterns and their exploitation consequences. app-secure (Defensive Benchmark): Production-ready, hardened reference implementations built with enterprise-grade controls (Jetpack Security, Google Tink AEAD, SQLCipher, and KeyStore StrongBox hardware keys). app-attacker (Live Rogue Process): A standalone companion application simulating malware to prove Inter-Process Communication (IPC) vulnerabilities, component hijacking, and intent leaks in real time on a physical or virtual device.
Core Engineering Pillars
78 Isolated MASWE Modules: Spanning Storage, Cryptography, Authentication, Network, Platform Interaction, Code Quality, Resilience, and Privacy across fully isolated Gradle compilation units.
Regulation-Grade Data Ontology: Moving beyond trivial test data by utilizing realistic synthetic payloads modeled after GDPR (Article 4/9 PII), HIPAA (§164.514 PHI), and PCI-DSS (Requirement 3.2 Track 2/CVV) regulations.
Multi-Layer Verification: Out-of-the-box support for dynamic instrumentation (Frida hooks), static security analysis (Semgrep CI/CD rules), and automated device validation (ADB scripts).
Pedagogical Approach & SSDLC Integration
Traditional security labs present vulnerabilities in isolation without showing developers how to architect the defense. The Android Security Masterclass bridges this gap by integrating security directly into the Modern Android Development (MAD) workflow.
By inspecting both the flawed implementation and the cryptographic mitigation side-by-side, engineering teams and students learn how to design secure architectures from day one rather than relying on reactive patches.
Who Is This For?
Android Developers looking to master secure coding practices, hardware-backed cryptography, and defensive architectures in Kotlin and Jetpack Compose.
Mobile Penetration Testers seeking an advanced, calibrated testbed to validate SAST, DAST, and runtime exploitation techniques against MASVS v2.0.
Security Champions & AppSec Teams aiming to establish secure baseline standards and CI/CD security gating within their mobile engineering organizations.
Project Resources
Project Leaders
Hasan Tuncay
Android & Multiplatform Developer and Project Leader for the OWASP Android Security Masterclass. Translator and editor of premier mobile and Kotlin literature (including Kotlin Coroutines by Marcin Moskała, Atomic Kotlin by Bruce Eckel, and The Manifest of Android Interview by Jaewoong Eum). Focused on modern mobile architectures, Compose Multiplatform, and defensive security engineering aligned with OWASP MASVS/MASWE standards.
Project Information
Slack