OWASP MASTG: the manual is a web page, with versioned GitHub releases

MASVS to MASWE to MASTG is the order the project wants you to read

Three names sit in one chain, and the README prints the arrows between them: OWASP MASVS, then OWASP MASWE, then OWASP MASTG. The verification standard holds the controls, the weakness enumeration holds the weaknesses, and MASTG is the manual that describes technical processes for verifying those MASWE weaknesses, which are in alignment with the controls in MASVS. That ordering decides how you use the text. If your audit checklist is written against MASVS control identifiers, MASTG hands you the procedure behind a control rather than the verdict, and the verdict stays a judgement you write and defend. Nothing in the repository turns a procedure into a result, so a reader expecting a tool has to look somewhere else entirely.

The text is a web page and the checklist is a release artifact

The MASTG Web link points at mas.owasp.org/MASTG/, which is where the guide is actually read. The split matters the moment you pin versions. v1.8.0 and v1.9.0 were both published on 2026-06-24, twenty-four minutes apart, and v2.0.0 followed on 2026-06-30. A release you downloaded can therefore describe a different set of chapters than the web text you read on the same afternoon. The repository was pushed on 2026-11-02, so the web edition keeps moving long after any single release you downloaded.

Python is the primary language and no install step is documented

The repository's primary language is Python, and the top level carries utils/ and tools/ next to techniques/, rules/ and knowledge/. What it does not carry is a documented way in. There is no install line, no requirements file at the root, no pip command and no invocation anywhere in the README, so a reader who wants to run something from this repository has nothing to copy. Treat any script under utils/ or tools/ as undocumented: its inputs, its output and the Python version it expects are all yours to discover by reading it. The consequence for an assessment team is that MASTG cannot be dropped into a pipeline as a tool. Plan to use it as reading plus a procedure you write yourself, and budget hours for that procedure.

Two markdown checks are the only automated gates the badges advertise

The badges point at two workflows, markdown-linter.yml and url-checker.yml, and the root holds .markdownlint.jsonc, .markdownlint-cli2.jsonc and .markdownlinkcheck.json to configure them. Both check the shape of the writing, not the truth of the procedure. The tree also contains tests/, tests-beta/, demos/, prerequisites/ and apps/, but no badge advertises a job that runs them, so whatever verification lives in those directories is not the project's front door. The practical consequence is that nothing in the advertised continuous integration will tell you a technique's steps stopped matching the tools they name, or that a checklist no longer matches its chapter. That check falls on whoever last edited the text, which for a manual of this size is the real maintenance risk.

Crackmes and Samples are the practice material, and one sample path is listed

Practice material has its own directory and its own portal. Crackmes/ sits at the top level, and the README links a Crackmes page on mas.owasp.org, which is where deliberately weak targets live so a tester can rehearse a technique without touching a client's app. Samples/ holds sample code, and the only sample path in the repository listing is Samples/Android/. Open the Samples tree before you plan a study session on a second platform, because one listed path is not evidence of symmetry. The same asymmetry applies to your own targets: a procedure verified against one platform's sample says nothing about the other platform's runtime, and the guide does not close that gap for you.

CC BY-SA 4.0 with a CITATION.cff means the licence follows copied text

The licence is CC BY-SA 4.0, the badge sits at the top of the README, and License.md lives at the root. Share-alike is the part that changes what a team can do with the wording. Copy a procedure into an internal testing playbook, an audit template or a client deliverable, and the terms that governed the original travel with the copy, so a document that mixes MASTG sentences with your own proprietary material is no longer plainly yours to hand around. The tree also carries CITATION.cff for machine readable citation metadata and a CHANGELOG.md, which tells you the project expects to be cited as a versioned work rather than quoted loosely. Copyright on third party tools you name inside a test case is a separate question this repository does not settle.

The Trusted by section is a link, not a list of names

The README has two adoption sections and neither names an organisation in the text. Trusted by points at an adoption page, 0x02b-MASVS-MASTG-Adoption, and says the standards are trusted by platform providers and standardization, governmental and educational institutions. MAS Advocates is defined as industry adopters who have invested a significant and consistent amount of resources, with its own page at 0x02c-Acknowledgements. So the adoption claim lives one click away rather than in the file you are reading. That is a reading instruction, not a complaint: if adoption matters to your decision, open both pages, because nothing in this repository lets you confirm who is listed or when they joined. The chapter numbering also shows the web guide is slotted, 0x02b and 0x02c sitting beside 0x02, which makes a deep link the stable way to cite one specific page.

Editorial conclusion

MASTG fits teams that already work from MASVS controls and need a written procedure plus something to rehearse that procedure against, such as the Crackmes. Skip it if you need an installable scanner or an automatic evidence trail, because this repository ships a manual, and its two advertised checks cover markdown and links only. Before you rely on any of it, pin the release you are actually quoting rather than the latest one, and read License.md first: the CC BY-SA 4.0 terms travel with procedure text you copy into an internal playbook.

Frequently asked questions

Official sources

1. License: CC-BY-SA-4.0
2. OWASP/mastg on GitHub
3. Project website
4. README
5. Releases