CASA (Cloud Application Security Assessment) is Google’s security review program for third-party apps that access Google user data through OAuth. If your app requests sensitive or restricted scopes — Gmail write, Calendar, Contacts, etc. — Google requires a CASA assessment before approving your OAuth consent screen.

The tier system

CASA has three tiers. Google assigns a tier based on the scopes your app requests and the number of users.

Most OAuth apps requesting sensitive scopes land in Tier 2.

What Tier 2 requires

A Tier 2 assessment has two parts:

1. Automated scanning — the assessor runs OWASP ZAP-style tools against your app, checking security headers, TLS configuration, input validation, error handling, CORS, and HTTP method enforcement.

2. Manual verification — the assessor reviews the scan results, checks OAuth flow implementation, and verifies that the app handles tokens, redirects, and error states securely.

The assessment is performed by a Google-authorized lab (like TAC Security, Leviathan Security, Bishop Fox, or others on Google’s approved list). You can’t self-assess at Tier 2.

What the assessor actually tests

The Tier 2 assessment maps to OWASP ASVS (Application Security Verification Standard) Level 2 controls. In practice, the assessor checks:

• Security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, server version disclosure
• TLS — TLS 1.2+ enforced, valid certificate, HSTS, no mixed content
• HTTP methods — TRACE/TRACK blocked, unsupported methods return 405
• Error handling — no stack traces, no internal paths, no database errors, generic auth failures
• Input validation — SQL injection, XSS, path traversal, request size limits
• CORS — no wildcard with credentials, evil origins rejected
• OAuth flows — state parameter validation, code replay prevention, redirect URI enforcement, PKCE, token handling
• Rate limiting — 429 enforcement on sensitive endpoints

How vet maps to the assessment

Vet automates the first part: the automated scanning. It runs the same probes an assessor’s tools would run and produces a report mapped to ASVS control IDs.

What vet covers vs. what needs a human

Vet handles the mechanical, automatable checks. Some things still need a human assessor:

Vet handles:

• Header presence and correctness
• TLS version and certificate validation
• Error response content analysis
• Injection payload testing
• CORS policy verification
• HTTP method enforcement

Still needs a human:

• Business logic review (“does this permission model make sense?”)
• OAuth implementation nuance (custom flows, edge cases the tool can’t model)
• Manual exploitation of findings (“is this reflected XSS actually exploitable?”)
• Review of data storage and retention policies
• Code review for hardcoded secrets or insecure cryptography
• Verification that findings are truly fixed (not just masked)

The workflow

The intended workflow for CASA Tier 2:

1. Run vet against your app. Fix everything it flags.
2. Re-run vet to confirm all checks pass.
3. Submit for assessment with a Google-authorized lab.
4. The assessor’s job is now verification, not discovery. They confirm your app passes the same checks vet already ran, plus manual review items.

This dramatically reduces assessment time and back-and-forth. Instead of the assessor finding 20 issues and sending them back to you, they find 0–2 issues because you already caught them.

Cost and time savings

Without vet: The assessor finds problems → sends you a report → you fix → they re-test → repeat. Typical cycle: 3–6 weeks, multiple rounds.

With vet: You fix everything upfront → assessor verifies → done. Typical cycle: 1–2 weeks, one round.

The assessment fee ($550+) stays the same either way. Vet saves you time, not money on the assessment itself.