Release v3.5.0: Mobile App Edition v2.0

OWASP Cornucopia Mobile App Edition v2.0

We are happy to announce the release of the OWASP Cornucopia Mobile App Edition v2.0. The latest edition is compatible with MASVS v2.1, MASTG v2.0, and MASWE v1.0, and features 80 threats that cover all the requirements, tests, and weaknesses of the OWASP Mobile Application Security Project.

The latest edition is compatible with MASVS v2.1, MASTG v2.0, and MASWE v1.0, and features 80 threats that cover all the requirements, tests, and weaknesses of the OWASP Mobile Application Security Project.
The deck has six suits of 13 cards plus two jokers, with the suit names taken from MASVS:

• Platform & Code (PC)
• Authentication & Authorization (AA)
• Network & Storage (NS)
• Resilience (RS)
• Cryptography (CRM)
• Cornucopia (CM), which contains threats related to MASVS Privacy requirements, and where we have also added some nasty cards related to mobile malware.

The edition exists in English and has been translated into Hindi, Russian, and Ukrainian.
To play the game online, visit cornucopia.owasp.org and click on «Play online».

AI mobile development

With the new edition, you can also combine it with the OWASP Cornucopia Companion Edition. The new OWASP Cornucopia Companion Edition complements the existing two editions. The OWASP Cornucopia Companion Edition v1.0 comes with 6 companion suits covering new topics:

• Agentic AI (AAI)
• Automated Threats (BOT)
• Cloud (CLD)
• Frontend (FRE)
• Large Language Models (LLM)
• DevOps (DVO)

A suit in the companion deck may replace (or be used in addition to) suits in the existing Mobile App Edition so that players can add a specific focus to their threat modeling. Let’s say you are building an LLM mobile application and want to perform threat modeling and security requirement analysis specifically for Mobile and LLM. You would then use the OWASP Cornucopia Mobile App Edition and the LLM companion suite as your elected OWASP Cornucopia focus area.

What's Changed

• build(deps): bump mvdan/shfmt from ce35e16 to 2309e72 by @dependabot[bot] in #3443
• build(deps-dev): bump svelte from 5.56.10 to 5.57.0 in /cornucopia.owasp.org by @dependabot[bot] in #3440
• build(deps): bump coverage from 7.15.4 to 7.16.0 by @dependabot[bot] in #3439
• build(deps): bump python-discovery from 1.5.3 to 1.6.0 by @dependabot[bot] in #3438
• build(deps): bump virtualenv from 21.7.5 to 21.7.7 by @dependabot[bot] in #3437
• build(deps): bump phoenix_live_view from 1.2.10 to 1.2.11 in /copi.owasp.org by @dependabot[bot] in #3431
• build(deps-dev): bump mox from 1.2.0 to 1.3.0 in /copi.owasp.org by @dependabot[bot] in #3430
• build(deps): bump dns_cluster from 0.2.0 to 0.3.0 in /copi.owasp.org by @dependabot[bot] in #3429
• build(deps): bump click from 8.4.2 to 8.5.0 by @dependabot[bot] in #3427
• build(deps): bump mvdan/shfmt from 2309e72 to cf9085b by @dependabot[bot] in #3445
• build(deps-dev): bump typescript-eslint from 8.68.0 to 8.69.0 in /cornucopia.owasp.org by @dependabot[bot] in #3452
• Eop card browser/refactor mentor followups by @ayman-art in #3331
• Add AA suit by @sydseter in #3444
• build(deps): bump filelock from 3.32.4 to 3.32.5 by @dependabot[bot] in #3451
• build(deps): bump coverage from 7.15.4 to 7.16.0 by @dependabot[bot] in #3450
• build(deps-dev): bump @typescript-eslint/parser from 8.68.0 to 8.69.0 in /cornucopia.owasp.org by @dependabot[bot] in #3449
• build(deps): bump phoenix_live_dashboard from 0.9.0 to 0.9.1 in /copi.owasp.org by @dependabot[bot] in #3448
• build(deps-dev): bump mox from 1.3.0 to 1.3.1 in /copi.owasp.org by @dependabot[bot] in #3446
• Update Dockerfile by @sydseter in #3464
• build(deps): bump virtualenv from 21.7.7 to 21.7.8 by @dependabot[bot] in #3459
• build(deps): bump mvdan/shfmt from cf9085b to 6569b30 by @dependabot[bot] in #3456
• Mobile card scenarios by @sydseter in #3463
• build(deps): bump swagger-ui-dist from 5.32.14 to 5.32.15 in /cornucopia.owasp.org by @dependabot[bot] in #3468
• docs(eop): add scenario for TA3 tampering card by @prajakta128 in #3466
• build(deps-dev): bump eslint from 10.9.1 to 10.10.0 in /cornucopia.owasp.org by @dependabot[bot] in #3469
• Adding mastg, maswe and mobileapp api v2.0 by @sydseter in #3471
• Adding MASVS requirements to the cards by @sydseter in #3470
• Externalize copyright text and add the cases for v2 and move to CC-SA-4.0 by @sydseter in #3472
• Fixing pack of the card for AA3 (with mapping) by @sydseter in #3478

Full Changelog: v3.4.12...v3.5.0