The OWASP Mobile Top 10 is a ranked list of common mobile app risks, starting with Improper Credential Usage and ending with Insufficient Cryptography. It is an awareness list for developers and testers. For a testable set of requirements, use the OWASP MASVS instead.
The ten risks
The project's risk list reads:
- M1 Improper Credential Usage
- M2 Inadequate Supply Chain Security
- M3 Insecure Authentication/Authorization
- M4 Insufficient Input/Output Validation
- M5 Insecure Communication
- M6 Inadequate Privacy Controls
- M7 Insufficient Binary Protections
- M8 Security Misconfiguration
- M9 Insecure Data Storage
- M10 Insufficient Cryptography
The project's main page presents a 2024 release. The list above is from the project's risks page. Check the project site for the current ordering before you cite it.
What each means in practice
- Credentials: keys, tokens or passwords hardcoded in the app or stored badly. Anyone can unpack an app.
- Supply chain: third party SDKs and libraries you did not write or review.
- Authentication and authorization: checks done only in the app, where an attacker can bypass them. OWASP's mobile cheat sheet says to authenticate and authorize on the server.
- Input and output validation: trusting data from the network, other apps or deep links.
- Insecure communication: traffic without TLS, or code that skips certificate validation.
- Privacy: collecting or exposing more personal data than needed.
- Binary protections: an app that is easy to tamper with, repackage or reverse.
- Misconfiguration: debug flags, exported components and permissive settings.
- Data storage: secrets in plain files, logs, caches or backups.
- Cryptography: weak algorithms or home made crypto.
Where to start
OWASP's mobile cheat sheet gives a short list worth acting on today:
- Keep keys in the platform keystores, the iOS Keychain and Android Keystore.
- Never disable certificate validation.
- Never hardcode credentials in the app.
- Do not store user passwords on the device. Use revocable, device specific tokens.
- Keep third party libraries updated from trusted sources.
Top 10 or MASVS
The Top 10 tells you what to worry about. MASVS tells you what to verify. See MASVS control groups.
Where Safeguard fits
For M2, Safeguard's SBOM and dependency scanning can inventory the libraries in your mobile build, and the free scan at gold.safeguard.sh/scan is a place to start.
Quick check
Is supply chain on the mobile list?
Yes. M2 is Inadequate Supply Chain Security.
Should we use certificate pinning?
OWASP says to consider it and weigh the trade-offs. Never disable normal certificate validation either way.
Sources
- OWASP Mobile Top 10 project
- OWASP Mobile Top 10 risks list
- OWASP Mobile Application Security Cheat Sheet
Last reviewed: 19 October 2026.
