[Copilot]

Adds MASTG content for the AndroidX Security State library (androidx.security:security-state), which reports per-component patch compliance and update availability beyond Build.VERSION.SECURITY_PATCH. It does not cover device authenticity or tampering; Play Integrity is needed for that.

All IDs are drafting placeholders (0x01). Real IDs need to be assigned after review.

• Knowledge (MASTG-KNOW-0x01, MASVS-CODE)
  • Describes SecurityStateManager and SecurityPatchState, the vulnerability report feed, and the library's scope.
• Best practice (MASTG-BEST-0x01)
  • Check the per-component security state before sensitive flows, enforce the decision on the backend, handle report-load failures explicitly, and pair the check with Play Integrity.
• Test (MASTG-TEST-0x01, static)
  • Looks for Security State API usage and Build.VERSION.SECURITY_PATCH reads. It fails if the APIs are absent or their result is never evaluated.
  • Tagged MASWE-0077, chosen from memory because the MASWE list isn't in the repo. Please confirm.
• Rule (rules/mastg-android-device-security-state.yml)
  • Semgrep inventory rule (INFO) for the same APIs.
• Demo (MASTG-DEMO-0x01)
  • A sample that calls the APIs but ignores the result, so the test fails.
  • output.txt is real semgrep output (5 findings) from running the rule on MastgTest_reversed.java.

val manager = SecurityStateManager(context)
manager.getGlobalSecurityState()
val updated = SecurityPatchState(context).isDeviceFullyUpdated()
// result only returned to the UI, never used to gate anything

For reviewers

• I couldn't reach the Android docs from the sandbox, so the API names come from memory. Please check them against the docs.
• MastgTest_reversed.java is hand-written, not decompiled from a built APK.
• The Kotlin sample hasn't been built or run on a device, and the demo doesn't yet record platform version, IDE version or device.

• Fixes Add a new Test, Demo, Know and Best for Security State #4003