{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-3-gcs_bucket", "name": "GcsBucket", "shortDescription": { "text": "Google Cloud Storage reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/gcs_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "9.5", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-35-exported_provider", "name": "ExportedProvider", "shortDescription": { "text": "Exported ContentProvider without permission" }, "fullDescription": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "helpUri": "https://apk-scanner.com/finding/exported_provider", "help": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-926", "CWE-284", "MASVS-PLATFORM-1" ], "security-severity": "2.0", "cwe": [ "CWE-926", "CWE-284" ], "masvs": [ "MASVS-PLATFORM-1" ] } }, { "id": "APKSCAN-72-sentry_dsn", "name": "SentryDsn", "shortDescription": { "text": "Sentry DSN" }, "fullDescription": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "helpUri": "https://apk-scanner.com/finding/sentry_dsn", "help": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-62-sbom_cve", "name": "SbomCve", "shortDescription": { "text": "Bundled component with a known CVE" }, "fullDescription": { "text": "Confirm the bundled version, then upgrade the dependency to a patched release; track third-party components in an SBOM." }, "helpUri": "https://apk-scanner.com/finding/sbom_cve", "help": { "text": "Confirm the bundled version, then upgrade the dependency to a patched release; track third-party components in an SBOM." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "CWE-937", "CWE-1104", "MASVS-CODE-3" ], "security-severity": "5.0", "cwe": [ "CWE-937", "CWE-1104" ], "masvs": [ "MASVS-CODE-3" ] } } ] } }, "automationDetails": { "id": "apk-scanner/ai.character.app/1bcb4ee8-c7d6-4f88-a39a-57ff10a8bb22" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-3-gcs_bucket", "level": "error", "message": { "text": "Google Cloud Storage reference — confirmed publicly readable [live-verified]" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "a8a3020fb6703551f63c8b194ffbba8992d94b4a668e6daf0d91d2c533b97d06" }, "properties": { "severity": "critical", "verified": true, "relationship": "verified-exposure" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "error", "message": { "text": "Google Cloud Storage reference — confirmed publicly readable [live-verified]" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "2cbeda0d3a32ca53459444c6b843fb7af270faf48e96b04ef7d25b9138d8841b" }, "properties": { "severity": "critical", "verified": true, "relationship": "verified-exposure" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "error", "message": { "text": "Google Cloud Storage reference — confirmed publicly readable [live-verified]" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "7db22c4081050c1552c9f3174a491dcd40cb33067bfe60f2a2824dfa976993fd" }, "properties": { "severity": "critical", "verified": true, "relationship": "verified-exposure" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "error", "message": { "text": "Google Cloud Storage reference — confirmed publicly readable [live-verified]" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "e270e0cccea6c501f2175dd598bcebefab8019d24109f06a97264af8b50074be" }, "properties": { "severity": "critical", "verified": true, "relationship": "verified-exposure" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes13.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "d089e891e9dbf4290afab1a7f8483291a75752bc6362a162864e8dfcb1020c51" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "2567404a4a9062798bb7d64e47001fe3c76db387004a4b9fb4ef75aca75b6b12" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "note", "message": { "text": "Exported content provider without permission (third-party library artifact, shared across 232 unrelated developers)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:ca.analytics.internal.PreloadInfoContentProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "e510d1eb34e8724fb89c83162bddb9cb7decb566898c4cfb5f1fc0556fb56332" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.android.bundle" } } } ], "partialFingerprints": { "apkscanFingerprint": "6bcfe387f3df4ff5ae9a0eef375525a7a2043f4ee6225c5d7b261eaa8a96c09f" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-62-sbom_cve", "level": "warning", "message": { "text": "com.squareup.okhttp3:okhttp 3.12.13 — CVE-2021-0341" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom:com.squareup.okhttp3:okhttp:CVE-2021-0341" } } } ], "partialFingerprints": { "apkscanFingerprint": "b35496237e28b68c8e0d69cddebe93abcbdeb329cec963569542cc48edb144a4" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-signal" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 61195.442, "harvest": 16089.418999999983, "detectors": 42699.42699999994 }, "bytes_total": 287389597, "bytes_scanned": 287389597, "bytes_skipped": 0, "files_processed": 3099, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "305be7f79bc9db9e41a591a8c118f38c04778c105636db45be0321fed2b14d30" }, { "name": "config.arm64_v8a.apk", "sha256": "22b1b9d9afab6fd558b05f9883b781870b7fe647b5b1f8c540f97316179e6f58" }, { "name": "config.en.apk", "sha256": "299fc9a9f42c141377b2b964a1df3e9e910c5f3e7b44c6b981a6d07c2e71e132" }, { "name": "config.xxhdpi.apk", "sha256": "69a855b0cc37fbb0223f974af16dbbe2f9cc30da8a19ef3f5e5c5c0286916073" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "305be7f79bc9db9e41a591a8c118f38c04778c105636db45be0321fed2b14d30", "app_id": "ai.character.app", "app_title": "Character AI: Chat, Talk, Text", "app_version": "1.17.4", "scan_id": "1bcb4ee8-c7d6-4f88-a39a-57ff10a8bb22", "scanned_at": "2026-10-12T20:39:14.271Z" } } ] }