- MSTG-AUTH-1: "If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint." - MSTG-AUTH-8: "Biometric authentication, if any, is not event-bound (i.e. using an API that simply returns...