Static analysis. Clear evidence.

Understand your
app's risks.

Inspect Android APKs for embedded keys, manifest risks and tracking SDKs. Review clear findings, build evidence and the limits of every scan.

Scan an app → View sample report
Static APK analysis Recorded build evidence Redacted proof, private
A
Example Appcom.example.app
Illustrative report
Exposure grade
D
Finding categories
3
Occurrences
5
Analysis
Static
CriticalEmbedded key identifierDetected
HighExported componentDetected
HighTracking SDKDetected
PROOF (REDACTED)Redacted
{ "analysis_mode": "static", "analysis_status": "complete", "finding_categories": 3, "occurrences": 5, "values": "redacted" }
6,463apps analyzed
4,819scans in the last 7 days
92%ship a third-party tracker
61,860finding occurrences

Counts come from recorded public scans. The activity total uses a rolling seven-day window; new scans use static analysis.

Scan

Choose an app to assess

Upload an APK or paste a Google Play link — free package lookup; sign in for private uploads. You get a dated static-analysis report with build and coverage details. Files are analyzed, then deleted, never shared.

Look up a recorded report, or request a scan when a download is available.
What it finds

Findings you can investigate

Static checks identify review items in the APK. Each report distinguishes detections, analysis limitations and historical verification.

🪣

Cloud references

Identify S3, GCS and Firebase references. A reference alone does not establish public access.

🔑

Embedded keys & identifiers

Identify embedded key patterns and identifiers, with values redacted and contextual guidance.

🌐

Backend references

Find hard-coded service URLs and backend references for contextual review. A reference does not establish access.

📡

Tracker Inventory

Recognizable third-party SDKs and trackers. A static inventory does not establish how data is used at runtime.

📄

Manifest Risks

Exported components, cleartext traffic, debuggable builds, deep-link hijack surface and more.

♻️

Build-to-build changes

Compare recorded scans to review added or removed findings. Removal from a build does not establish credential revocation.

How it works

From APK to a readable report.

Review the APK, inspect the evidence and track changes between recorded builds. New scans do not probe detected backends.

1

Scan

Download & analyze the shipped app — DEX, resources, native libs, manifest.

2

Review evidence

Finding categories, redacted occurrences and coverage metadata explain what was assessed.

3

Monitor

Watch apps for changes between recorded scans, with dates and build context.

Who it's for

Evidence for different review workflows

🎯

Researchers & Hunters

Prioritize static findings and inspect the evidence and analysis limitations.

👩‍💻

Developers & App Teams

Review a build before release and compare changes between recorded scans.

⚖️

Compliance & Legal

Use dated findings as input to a broader assessment, with coverage and limitations attached.

☂️

Insurers & Intel

Portfolio-scale exposure signal for underwriting and third-party risk.

Pricing

Start free. Add capacity when you need it.

Browse public reports on every plan. Sign in for private uploads. Paid plans add higher limits and API/export access.

Free

$0/mo
  • 3 scans / day
  • Watch 3 apps
  • Public reports & private uploads
Get started

Pro

$99/mo
  • 100 scans / day
  • Watch 50 apps
  • Private reviews, API & CI gate
Explore Pro

Team

$399/mo
  • 5,000 scans / day
  • Watch 2,000 apps
  • Pro investigation tools & API access
Explore Team

Enterprise

Custom
  • Discuss higher volumes
  • Data access requirements
  • Agree scope with sales
Contact sales

Monthly prices in USD; applicable tax is calculated at checkout. Compare all features and annual billing →

Private uploads. Reports visible to their owner. Redacted evidence. Sensitive values withheld. Recorded coverage. Limits shown with results.