{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-4-aws_access_key", "name": "AwsAccessKey", "shortDescription": { "text": "AWS access key ID" }, "fullDescription": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "helpUri": "https://apk-scanner.com/finding/aws_access_key", "help": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "8.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-1-s3_bucket", "name": "S3Bucket", "shortDescription": { "text": "Amazon S3 bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/s3_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-2-firebase_rtdb", "name": "FirebaseRtdb", "shortDescription": { "text": "Firebase Realtime Database reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_rtdb", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-3-gcs_bucket", "name": "GcsBucket", "shortDescription": { "text": "Google Cloud Storage reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/gcs_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-77-ds_underdeclare", "name": "DsUnderdeclare", "shortDescription": { "text": "Data Safety label omits an observed data category" }, "fullDescription": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "helpUri": "https://apk-scanner.com/finding/ds_underdeclare", "help": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-359", "MASVS-PRIVACY-3" ], "security-severity": "2.0", "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-3" ] } } ] } }, "automationDetails": { "id": "apk-scanner/br.com.intermedium/a1e11c13-f5b2-406f-b04b-224b9a0fbb52" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-4-aws_access_key", "level": "error", "message": { "text": "AWS access key ID" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/payloads/terms_payload.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "f5e7bece9de8dfcd22f2c8bb7e7734ade4c2ab9606e5aa617b7de10f99056383" }, "properties": { "severity": "high", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/notification_banner_response_mock_not_dismissible.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "8a1ab67765ca4cd37089f90c75a2d34ccc5076c322d3b4f32e231bec04e0c8af" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/personal_help_center_pf_black_mock.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "ae5faaa0954538258e8632fdddddb4c1ce10683868d3f47acfc89b01816db0dc" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/mgm_sdui_pdf_screen.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "c295a5184f5a77fe48a0ecf5e3b1e94c5bfe2cecfdbf92b0e88689b83c9e9b4c" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes4.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "e0567c813284e566ef4e453e2015814c80777d35b05d3d8c663d93eb61dbf8d7" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes9.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "d4440ec6cbb230998d802b287546df97b0a50ff2d78d769e3a2965beed890844" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/payloads/terms_payload.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "4aa5e16e5f727fb8612938380936edd34bca0d8ea12ac20ac4f10b234c200ce6" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes5.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "d83777d9a5dde1b9f693758a76d8b449829846f8c59c0b95d6b6e530a709d882" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes5.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "ce37b3d3e3036aab2c287757de74bebb41d7d54a03b6256c1b24d948ce54b14d" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/personal_help_center_pj_middle_mock.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "9ec75dd01741cee9847b292e50d8c81198ddc48e5ed3cd876080933fc598c6f6" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/personal_help_center_pf_win_mock.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "bf1dce1fe4226980e94afde441db0530aa9e95013bf62e6b9855124bdcb2b100" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes4.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "18beff07be40afe5441a8ae43a37327d3811de1eebc26d5cbeae048aac684701" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-2-firebase_rtdb", "level": "note", "message": { "text": "Firebase Realtime Database reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "c550443d8da7e2d122ed405e383ec9e799021482ab892f0d8f6bc7fb62861c09" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/platform/lucy/standard-modern.html" } } } ], "partialFingerprints": { "apkscanFingerprint": "a98e716687076393ade30dd76047d7aa52ec90be90c03d925c43ed29b2af4cec" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/platform/lucy/templates/standard.css" } } } ], "partialFingerprints": { "apkscanFingerprint": "7a3cf06046e3a79626f7f041bc69c98dfb1780546959699a8676c6259335fe2b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/platform/lucy/templates/standard.css" } } } ], "partialFingerprints": { "apkscanFingerprint": "c34f14b38d94f22dc902c6729a8995980d6987e74248d466f6682c58ef20d456" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/platform/lucy/templates/standard.css" } } } ], "partialFingerprints": { "apkscanFingerprint": "aebbb2034eb87574641d1094011bbc1795a14bbf03a3078a02d6ed1ec370529c" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/platform/lucy/lucy.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "64b99e097453c69c0a4b08e5ab416773473b21fd28eaaa558a81fd5c9a0b4395" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes5.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "1edce6150a174cc45592c497e14861609cbdf8b82db5658a73e695deaee90840" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "b3f46b46ac6818c0d6342c72d21d9a39c2f5b659953c12dade48e8456bf9175b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "aeb8e458a4b219757b12cca7cfb97dd16e92ce72576d675d08ef1334ceba2cac" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml" } } } ], "partialFingerprints": { "apkscanFingerprint": "617bcc9103488ef8605aaa34c0767ef36f089e3b738468cdd6f92484acc71f6f" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "c1a5417d7f2658c172840eb460d16932e47967e3461f6b549622d6a20d8bca0b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes15.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "5bc1fd085499019baed17ba27ffc7b93e4c179805f44f420f36cb8f0d84e7b2c" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-77-ds_underdeclare", "level": "note", "message": { "text": "Data Safety label omits Contacts" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "data-safety:Contacts" } } } ], "partialFingerprints": { "apkscanFingerprint": "52d6df5eafe80ad7de0275ee425de0bf8d715439e92a9026117bea4d546827d0" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 110672.565, "harvest": 25308.355000000043, "detectors": 76214.06500000077 }, "bytes_total": 484687073, "bytes_scanned": 484687073, "bytes_skipped": 0, "files_processed": 13782, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "9c20b878aa3f5862c0071bd8fa5ccb3f0d7d55ca7686d062e5f41aa95579942c" }, { "name": "config.arm64_v8a.apk", "sha256": "a526360b452607385f7f391ac2d691d5d4816978ecebc5e84b75bb6974b021fb" }, { "name": "config.xxhdpi.apk", "sha256": "0906e517792eecf160120527f750a90fa645dafe6aaccc2536c8f0180df3f2ad" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "9c20b878aa3f5862c0071bd8fa5ccb3f0d7d55ca7686d062e5f41aa95579942c", "app_id": "br.com.intermedium", "app_title": "Inter Banking & Money Transfer", "app_version": "26.16", "scan_id": "a1e11c13-f5b2-406f-b04b-224b9a0fbb52", "scanned_at": "2026-10-09T11:35:11.637Z" } } ] }