{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-37-allow_backup", "name": "AllowBackup", "shortDescription": { "text": "android:allowBackup=\"true\"" }, "fullDescription": { "text": "Backup is on by default on Android; this manifest states it explicitly. If the app stores sensitive local data, define dataExtractionRules/fullBackupContent to exclude it, or set android:allowBackup=false." }, "helpUri": "https://apk-scanner.com/finding/allow_backup", "help": { "text": "Backup is on by default on Android; this manifest states it explicitly. If the app stores sensitive local data, define dataExtractionRules/fullBackupContent to exclude it, or set android:allowBackup=false." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-530", "CWE-312", "MASVS-STORAGE-1", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-530", "CWE-312" ], "masvs": [ "MASVS-STORAGE-1", "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-2-firebase_rtdb", "name": "FirebaseRtdb", "shortDescription": { "text": "Firebase Realtime Database reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_rtdb", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-72-sentry_dsn", "name": "SentryDsn", "shortDescription": { "text": "Sentry DSN" }, "fullDescription": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "helpUri": "https://apk-scanner.com/finding/sentry_dsn", "help": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200" ], "masvs": [ "MASVS-STORAGE-2" ] } } ] } }, "automationDetails": { "id": "apk-scanner/air.com.playtika.slotomania/a070b70d-3342-4c74-952f-9d6a4ea4453e" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-37-allow_backup", "level": "note", "message": { "text": "Application data is backup-enabled" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml" } } } ], "partialFingerprints": { "apkscanFingerprint": "68d134f0bcd98a9559d6dd5275f80a3928e4a6490ac4a0f1bd16f87683bd49f8" }, "properties": { "severity": "info", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-2-firebase_rtdb", "level": "note", "message": { "text": "Firebase Realtime Database reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "90df4ca121d6854af245de4c086cf0b1463a2240346734c80329a16304d28200" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "350a40fdbbedeb6d1cc7ccd6a4edeb96377565ae8a6c737e70d437aae5dac804" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes3.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "8956282475bd4dc9c08e666a2d833d20d387a82acb8c194a8c26fcfd323187e3" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/native-preloader.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "3566dc77dd4bb0054a2ae8f72131eca96376bf1e575f285f6faed15955a2b456" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/native-preloader.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "2a0de51ae2a2b04862dfa797dc450a2b5d3ab71cafc188c2b9dc6335fe19f8fc" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/native-preloader.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "24b5cbd5c30abdc76f8d6ec2c4ff4aafe711f5fd3157407b111fb3812cf0e112" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/native-preloader.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "9c5fc13ce9cee6d30ccb6a8d744af2e3bd809a09ca70bf65583f1abf4634462d" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/native-preloader.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "5a823acf141f60593228fb0e0872cf876199fafc227422ba74e416e379abb3b2" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/native-preloader.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "f46bb4a029eff2417a41de77dd181ffcf0e2ff8d3eb494b81d52884120a8db00" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/native-preloader.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "623f69320f9af8d20985d8e3ef7fd473b9dceaded81888f35a3a648302ced05f" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 69980.187, "harvest": 19569.776000000016, "detectors": 47437.77800000016 }, "bytes_total": 355890210, "bytes_scanned": 355890210, "bytes_skipped": 0, "files_processed": 3550, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "ae7b0174c1da67b680826e45843f958df540b69e7ea9f06995ebeda13486f091" }, { "name": "asset_pack.apk", "sha256": "d405db8d2873fd121a76841c02e860cf2a08cf7b204baeac819068723e7aa953" }, { "name": "asset_pack.config.group_medium_performance_astc.apk", "sha256": "4b84ee1cadd8426199bd30d54dfb76a1a1ad2f989d22a99670855c5fe7cb8f86" }, { "name": "config.arm64_v8a.apk", "sha256": "f5c40cf57cea90f22d34ed92d5fccaf60950506a4253169bfddf1caf66940b20" }, { "name": "config.en.apk", "sha256": "e46caee444493d0b64cb0546fe92dca6424fbefc211f8b6b9e7f4ede71dccc8c" }, { "name": "config.xxhdpi.apk", "sha256": "da219ee4a568163f7c9ce6ac7b52e5da212a11ce544bc6d68ea47d22047656fd" } ], "ruleset_sha256": "f845a46700295ef0c808b2accb30ba973aca62f3b52fef51e8489d1916061a63" }, "apk_sha256": "ae7b0174c1da67b680826e45843f958df540b69e7ea9f06995ebeda13486f091", "app_id": "air.com.playtika.slotomania", "app_title": "Slotomania™ Slots Casino Games", "app_version": "77.168.20", "scan_id": "a070b70d-3342-4c74-952f-9d6a4ea4453e", "scanned_at": "2026-10-14T08:13:25.546Z" } } ] }