{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-4-aws_access_key", "name": "AwsAccessKey", "shortDescription": { "text": "AWS access key ID" }, "fullDescription": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "helpUri": "https://apk-scanner.com/finding/aws_access_key", "help": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "8.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-1-s3_bucket", "name": "S3Bucket", "shortDescription": { "text": "Amazon S3 bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/s3_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-2-firebase_rtdb", "name": "FirebaseRtdb", "shortDescription": { "text": "Firebase Realtime Database reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_rtdb", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-60-bg_location", "name": "BgLocation", "shortDescription": { "text": "Background location access" }, "fullDescription": { "text": "Justify background location; request foreground-only where possible and disclose the use in the Play Data Safety form." }, "helpUri": "https://apk-scanner.com/finding/bg_location", "help": { "text": "Justify background location; request foreground-only where possible and disclose the use in the Play Data Safety form." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-359", "MASVS-PRIVACY-1" ], "security-severity": "2.0", "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-1" ] } }, { "id": "APKSCAN-35-exported_provider", "name": "ExportedProvider", "shortDescription": { "text": "Exported ContentProvider without permission" }, "fullDescription": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "helpUri": "https://apk-scanner.com/finding/exported_provider", "help": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "CWE-926", "CWE-284", "MASVS-PLATFORM-1" ], "security-severity": "5.0", "cwe": [ "CWE-926", "CWE-284" ], "masvs": [ "MASVS-PLATFORM-1" ] } } ] } }, "automationDetails": { "id": "apk-scanner/com.amazon.dee.app/729b42ff-c07e-4f66-9e9f-d4158aa9eb6c" }, "invocations": [ { "executionSuccessful": false } ], "results": [ { "ruleId": "APKSCAN-4-aws_access_key", "level": "error", "message": { "text": "AWS access key ID" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "a2586b128c8bd25aa9ef37e93b1cb01daaf9a55c043bffc658cad849cd6db2b0" }, "properties": { "severity": "high", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-4-aws_access_key", "level": "error", "message": { "text": "AWS access key ID" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "7876b0d8c52a8c8ca1ff57c623b9e825918a91bb9136caa749f5714cc63f045c" }, "properties": { "severity": "high", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes6.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "6d3265bf2f5e1221c48d93b1c227e7ca5f10732ade5bc66fdfaf8eac1681c80b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/smartfragments.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "4d2e5cc46fab04abf0ea53175db60917989d7663ecba025be7f47099c08384e7" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/smartfragments.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "9347ebc7c8414e19d6e9710f884f73868f4c81f743edc6be85577c17a83f83c1" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/smartfragments.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "2355279722dcd16a80829521de18821f6bd88cffd9972821d54a601e2e64d0b2" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/smartfragments.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "e0b23ae8d1e99df8bbd050acaa1c5464f1fb05bb2ee51ee3bce377598975f7d8" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/smartfragments.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "78e138bb5a5cca3c7f04c7593ff03a6d51e7120031b6152c5aab2733b0213bfe" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "3a231383285bdd42b56db7e7928ef444a57297c6f96b2c51783698568ec1c17f" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "c89f2204b26d7d2ceb4be80b4215040e9121beeb92106259de8f876b62f44bcf" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "e85d0a67714ef84e1daffc888d07ad4fb52f663b7a7bec7f1d703602fecfbda6" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "806557e6183a36bc68c4da2aa862dbbc1788813700e0308719690f5569271ec1" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "7ace29339ba4b67b7341c24cdb8b093dbdb7495d778a4a86b11a9f436e804797" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "7dd7bd71dc5ad8f66b103124e42f651e82b7a655a000cf2dfe5a6f0be42f3476" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "1b61c44df23ecbda0352d856b4136f0a614a5cfc5e11202854a278af820e9f16" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "1dbe09f07a36b4abbd68c24c0ff195c170f33f7f6917f57755936d8b0247bf2f" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "30c3c66b891a109d1a5b24749ddd45deb812d2f40b94be5501a076efab119ecc" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "ec50d65e6aca3d635dc80a7a6c0a72ba9197b2ec8eae589a08a32b3fdaded4c7" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "f0d5961e8a4dd714499f25d3b2cf5f163fe3bf679c2dfa83392fdd34c7959b5e" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "6727cbd9e81e3aa4b927e377a353477f09a01d1d4142b4666b849a6728ec6714" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/index.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "063aec3a40cf9faf1e1cb1826ef88f7fc3c6fe9d8d8c7bafd0a018c41d91adda" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/smartfragments.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "29e18ca779b0136e0f0cf7edd859eb0a417df4b9c6914ae6d13e64fecce05373" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/smartfragments.bundle.hbc" } } } ], "partialFingerprints": { "apkscanFingerprint": "5d18f93c257bae3fa0764481412ed8499b08bac48f379ef0dc6b05b39c928d6e" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-2-firebase_rtdb", "level": "note", "message": { "text": "Firebase Realtime Database reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "77d8c59ad00f0af0f957fd9125c8207a482e984c32abd9882a2914d7dff0f18c" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "f406ab9a9438a67cc5c0930ebe18f3a2785e35cb01fdab8fffd9054ea73d38aa" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "6952a40eb0360dc66726561f821f027ed5ad4f014289cd02dba63e70f111d33c" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-60-bg_location", "level": "note", "message": { "text": "Background location access with advertising SDKs present" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "pii:bgloc" } } } ], "partialFingerprints": { "apkscanFingerprint": "0c010d775be9542eee48043eb496c06888f9b8e8fcdf3af66a6b84e99192f6ce" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "warning", "message": { "text": "Exported content provider without permission" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:identity.auth.device.api.CrossAppContextProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "4d250703967c2d7231c701ba948b2ca2fce962ef900d454d730bbff4ce224209" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-confirmed" } } ], "properties": { "analysis": { "issues": [ "string_output_limit" ], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "partial", "manifest": "complete" }, "status": "partial", "grading": { "policy": "static-coverage-v1", "blockers": [ "analysis_incomplete", "string_output_limit", "strings_coverage_unavailable" ], "eligible": false }, "timings_ms": { "total": 86995.914, "harvest": 17397.923000000024, "detectors": 64773.66700000031 }, "bytes_total": 457454077, "bytes_scanned": 369169249, "bytes_skipped": 88284828, "files_processed": 7771, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "efb1de262df8b658ad8f725c4aba4f771d8eaed3b7bad4fbc33b7bca07bf4f04" }, { "name": "config.arm64_v8a.apk", "sha256": "90c0e9bd1c676ae671c90a50eddeb482bed792b1e772a891b6ad3ef6dcdb3480" }, { "name": "config.xxhdpi.apk", "sha256": "026e6e858a5e40ea5410651e6b72452c586b89679ba75463c06f4f2dc7c6b5fd" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "efb1de262df8b658ad8f725c4aba4f771d8eaed3b7bad4fbc33b7bca07bf4f04", "app_id": "com.amazon.dee.app", "app_title": "Amazon Alexa", "app_version": "2.2.718227.0", "scan_id": "729b42ff-c07e-4f66-9e9f-d4158aa9eb6c", "scanned_at": "2026-10-11T03:35:02.906Z" } } ] }