{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-72-sentry_dsn", "name": "SentryDsn", "shortDescription": { "text": "Sentry DSN" }, "fullDescription": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "helpUri": "https://apk-scanner.com/finding/sentry_dsn", "help": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-77-ds_underdeclare", "name": "DsUnderdeclare", "shortDescription": { "text": "Data Safety label omits an observed data category" }, "fullDescription": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "helpUri": "https://apk-scanner.com/finding/ds_underdeclare", "help": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-359", "MASVS-PRIVACY-3" ], "security-severity": "2.0", "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-3" ] } } ] } }, "automationDetails": { "id": "apk-scanner/com.bcbsmn.mobile/54af289f-6263-427f-a936-bf7ef543139d" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "73c29c487f7527512bbe01ec009aac25d18d812a4906088aae114dd35b9ea533" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KV3UPC5S.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "08a11d0a0c63ca7f9e6e294dfe782325d84b9e8498d73cb453194aceb3a8b0bb" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "04ed579661c1973bb2814e5d6e7de24cbcf0dac6bf521e73846fc5dce26c1499" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "d0eb59d638059d67b89972ffaaba8b651f29ad6e8500d55d4b91cfdbcf976822" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "80e6dbacb4aa95da00be21a5bc577448533a691e261cd074b8100317a643bea2" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "158f61e3c65a69068315b4f58e790144d925322b2cc2aef04db0844d6dfb5130" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "bcf3f241aa9497fa147c6d3c475eda58f1fe82d98760de02ae55041bfca6cd32" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "80e2a56b715fb002a5c60f94d462987c5ca2218178498e9ced482093bd8bac08" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "d777b4e7fda64d5ae8090d270e2e83b99c89b16f93e2e24e1fe2e6b5baf6668f" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "ffa683bc6d6544d6e25049fce151f94916ac898706bbe7cfc458ef5b4a373887" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "726ba2b755b48b72f6378c04758ded26455972f0711b5b9159a4b30edbb7bd1e" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "d72852ccd6fa484c6c127437d81c3d04d9fa1ee664438c69c8c3266b031d117d" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "6bd2a6ff98d146cbf3e177566a6e6592afbe3d04fe07b754d727d8252940b427" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "8967f4a81952fdbadf35316dcf3f5ec9e759dbd4b6479a9319df1dea1b6dbbfb" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "071c3d01f5dd3680f49e1aa76e6614a813d4d7afbe9e6aa0df5a8e9eb3914193" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "2084a5e4b9d938beaa7be2879ad8b99aaacf4eb6286577dde4686548e19cc1fe" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-O76FELFO.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "249f219fd811a65f239e2c21efcc7f93d6c61bdd508aa6dc6c6c79e5598580b0" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/public/chunk-KR7DGBIE.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "5a2fe7f9f8d4c033addb999b3a0cc1c629593402543f8e1306f66096e8f142df" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-77-ds_underdeclare", "level": "note", "message": { "text": "Data Safety label omits Location" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "data-safety:Location" } } } ], "partialFingerprints": { "apkscanFingerprint": "cacfd47daa7d0aafb7cbd1791f3964ef2850687203797b5e24429c41acdf7290" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-77-ds_underdeclare", "level": "note", "message": { "text": "Data Safety label omits Calendar" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "data-safety:Calendar" } } } ], "partialFingerprints": { "apkscanFingerprint": "2a94ef25c6a64a2fcc33bcb8d2ada6376b418ddfa745771aa213e568d5afb277" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 29373.476, "harvest": 3731.1370000000006, "detectors": 24139.941999999926 }, "bytes_total": 95622845, "bytes_scanned": 95622845, "bytes_skipped": 0, "files_processed": 3416, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "b88f45d530138a9da552962c63f396b97178b8e766e4c41aed72a023f6c8036a" }, { "name": "config.arm64_v8a.apk", "sha256": "173231462091b1cb8b182ebb50647b1a4a20e163ccfdc04c82e308f19955a90b" }, { "name": "config.en.apk", "sha256": "37eeef0fea5c12aa01a35d866567f8f8b3e918ba44b6627fe6a5c229b4e4a91b" }, { "name": "config.xxhdpi.apk", "sha256": "e1980c2c6fdc6414ebc0cc6a4a27baa3c7141a5c953727f8d0cab129602ec1c1" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "b88f45d530138a9da552962c63f396b97178b8e766e4c41aed72a023f6c8036a", "app_id": "com.bcbsmn.mobile", "app_title": "Blue Care Advisor", "app_version": "14.11.2", "scan_id": "54af289f-6263-427f-a936-bf7ef543139d", "scanned_at": "2026-10-03T20:27:10.352Z" } } ] }