← Back to report

Investigate Private key material (third-party library artifact, shared across 185 unrelated developers)

Build 9.40.0 · Scan 2026-10-12T21:57:02.471Z

3 distinct recorded findings; 3 have inspectable metadata. Locations are representative, not an inventory of every source match.

A complete PEM private-key block is embedded in the app. This is a real finding worth review — but it is often a bundled library test/sample key rather than a production secret, so we flag it high and leave confirmation to you (a bare header alone no longer triggers it).

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

classes7.dex

Recorded match

Pattern recorded; identifying value redacted.

Detector rule

private_key

Recorded file locations

• classes7.dex