[BUG] Demos can't be downloaded without Github authentication
Author: sgIOlasCreated Jul 3, 2026Updated Sep 18, 2026
LabelsTEMPORARILY-BLOCKED-FROM-ASSIGNMENT
Issue description
MASTG demo downloads return a 404 when trying to download artifacts without being authenticated in Github. This is a common issue that has been already discussed here for example. The intended behavior for us is that users are able to download demos without logged into Github.
How to reproduce
- Open a private web browser window.
- Navigate to any MASTG demo (e.g. https://mas.owasp.org/MASTG/demos/android/MASVS-RESILIENCE/MASTG-DEMO-0114/MASTG-DEMO-0114/).
- Try download de demo APK/IPA.
- Verify that Github returns a 404.
- Now repeat steps 2 and 3 while being authenticated in Github.
Possible solutions
Let's try to use this issue to brainstorm potential solutions to this problem. Here are some:
- Update all artifact references in MASTG to an OWASP backed public storage box. The publishing action would mirror the artifact result to this storage.
- Add a dummy release version with a non-standard version name such as "demos" and publish artifacts there from the action. Github seems to limit release size to 1000 artifacts (https://github.com/orgs/community/discussions/165616) so maybe this could be enough for our purpose.
Source: OWASP/mastg