ASVS V14: Configuration
Requirements covering build and deployment configuration — debug flags, exported components, and backup exposure.
Why It Matters
Configuration mistakes are structurally different from code vulnerabilities: they're binary — either the debug flag is off in the release build or it isn't — which makes them fully preventable with the right release checklist, yet they remain common.
Application to Application Security
In mobile, V14 covers android:debuggable and android:allowBackup flags, Android component export configuration, and any staging or development artifacts (test classes, non-production endpoints) shipped in a release build.
Relation to Software Development
Debug configuration is deliberately enabled during development and needs to be explicitly reverted for release — a step that depends entirely on build-pipeline discipline rather than application logic.
How Strata Surfaces This
Manifest parsing for debuggable and backup flags, exported-component detection cross-referenced against declared permissions, and detection of development artifacts left in release binaries.
Developer guidance
Maintain a release checklist that explicitly reverts every debug flag, and require a permission requirement on every exported component that doesn't intentionally need to be public.
Management guidance
A release checklist enforced by CI (failing the build on a debuggable release artifact) is more reliable than a manual pre-release review step.