Published on · Guide
Protecting offline apps without promising irreversibility
Offline behavior runs on the client. Resilience measures must be evaluated against an attacker who can observe that execution.
Offline remains a requirement
MASVS-RESILIENCE treats reverse-engineering and tampering resistance as defensive layers. For an offline recorder or calculator, test recording, computation and export without connectivity after protection. A new mandatory server dependency changes the product, not merely its security.
Spend effort on distinctive logic
Prioritize proprietary rules, algorithms and sensitive constants over ordinary buttons and system API calls. Combine transformations only when each layer has a clear target and measured compatibility cost. Information used during execution is not permanently secret merely because a file scan cannot find plaintext.
Your checklist
- Run core workflows in airplane mode.
- Measure startup, memory and battery changes.
- Document logic left outside protection.
Primary sources
- OWASP MASVS-RESILIENCE · Checked 2026-10-12