{ "app": { "app_id": "com.carxtech.sr", "title": "CarX Street", "version": "1.22.0" }, "scan": { "scan_id": "b4645c13-631c-4fcb-8e25-bb24183aac9a", "grade": "F", "score": 0, "scanned_at": "2026-10-09T16:47:24.587Z" }, "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 235427.228, "harvest": 166389.94000000003, "detectors": 53618.74399999981 }, "bytes_total": 2470118820, "bytes_scanned": 2470118820, "bytes_skipped": 0, "files_processed": 3825, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "dc96f428f843d3cad187390ec3475efdaef92dc317579251842f453f21e4dc87" }, { "name": "art_assets_all.apk", "sha256": "4360cb5f3f461dab3259eeb0b93e7d9b05ab885e82ee7d8e5487d75c0984205d" }, { "name": "audio_0_assets_all.apk", "sha256": "4df659787517c76105034d8e94498b2cf97cc7ebb723c3eb637cb7aa329daa69" }, { "name": "cars_0_assets_all.apk", "sha256": "46ec0221462844143395f6e14d5d5f46a835d877979f2886358677aeffd56359" }, { "name": "cars_1_assets_all.apk", "sha256": "69a2532a53c5d8bf32cf16493628a26709273f897bb999410b5eb771ca608590" }, { "name": "cars_2_assets_all.apk", "sha256": "965c2fd8283462757942a1a668322f3351152cdcbe4419dd5469dc7300d33db7" }, { "name": "cars_resources_prefabs_assets_all.apk", "sha256": "1a8e05a82de962e1d84886ad38e0181f78e146b9c28a1ce384efe412b05c626c" }, { "name": "config.arm64_v8a.apk", "sha256": "3a8e8d6ee39b460b1d2d293c98152a3e0f8060f88d2c695ec7da9f98107071c4" }, { "name": "resources_art_assets_all.apk", "sha256": "8b1081ba671d27b2bb37bc92e5d4acbef1abde7774dd536b5e46ead75540657e" }, { "name": "resources_assets_all.apk", "sha256": "426ad927bee78c5b7e2ff76eb0afbb58f77ce1c11608c67a00600a2f6bbaa59f" }, { "name": "resources_prefabs_assets_all.apk", "sha256": "6466a25d1bcf63c1ee90a89137f4dcfed0f79b8ecb73eeaa7fed9a07e924c90a" }, { "name": "resources_prefabs_ui_assets_all.apk", "sha256": "f3bdc37c5eec5ca2d862eba0e82ad14cf24f4acf5276cd57ab5fb34f75ad7ea9" }, { "name": "resources_ui_assets_all.apk", "sha256": "fb22041f7c32b9222e0d92d4b915699743d9973291bb49103e8a89b03a180c39" }, { "name": "resources_ui_atlases_assets_all.apk", "sha256": "70c9f41343dcf76de7d53210131766620861f4d470f58cfc4318e07c690272a0" }, { "name": "scenes_assets_all.apk", "sha256": "9b36ac7258a3c8d841048d8a5d763442af6a2839c739760ddfd4e4f8701a3394" }, { "name": "shared_assets_all.apk", "sha256": "ef1c0a9e2892f6dafc1293f8d49f2c7deb9235f09a04281bd59749754446f7c4" }, { "name": "shared_cars_assets_all.apk", "sha256": "f919b6bc12401ba0075b15314e453daab71a701d923c7cd9a135f182bb4dde56" }, { "name": "shared_models_assets_all.apk", "sha256": "8f529ca6bca1d49ffb5d29fa1e2673474088fdf602831f49205f0638bf8c25cc" }, { "name": "shared_prefabs_assets_all.apk", "sha256": "83b75110fd2bbad276156ead037062de8556cd29e55cb62a9e5dba764cf2908f" }, { "name": "streaming_data_car_market_bundle_0_assets_all.apk", "sha256": "8a24e979bb14616789d823ec6e29c99b2181986e8abb11a274e46ca367b3d667" }, { "name": "streaming_data_car_sale_bundle_0_assets_all.apk", "sha256": "aa90dc3fd7966aedd104003f8ed24da358158e384722f67639e791629f605f4a" }, { "name": "streaming_data_car_showroom_bundle_0_assets_all.apk", "sha256": "1df3c2da09a8201e393b7bec83ffde23186065c18958c8c885c27d7e517ecc94" }, { "name": "streaming_data_common_bundle_0_assets_all.apk", "sha256": "a91f0d7c4e68ee657956070298e2ce3ab35c5f4c3ad89fae490a86a356e10e5b" }, { "name": "streaming_data_common_bundle_1_assets_all.apk", "sha256": "827ed69df35860365ea4a8c42a1e31f6acb65e766a37f8c7de7a32c60c3ff3d7" }, { "name": "streaming_data_common_data_bundle_0_assets_all.apk", "sha256": "0341a207319c8aee3cb47f229d716ad928f4339fc468d250e3fe69d7ad2d1ea8" }, { "name": "streaming_data_entities_0_assets_all.apk", "sha256": "b3255f29894f8796e520dc8284b38f534ddd2304256fc9aec183351fbee45aa0" }, { "name": "streaming_data_entities_car_market_0_assets_all.apk", "sha256": "1ce06de269f897a6f9a164f6e0355b2800dd6788ab5bc2c997e6f3430fdaa9d1" }, { "name": "streaming_data_entities_car_showroom_0_assets_all.apk", "sha256": "866c56e9229f14775237130e71d44a2e6782e05d486bc59d38e5af5887a891c2" }, { "name": "streaming_data_entities_common_0_assets_all.apk", "sha256": "3f2ec6ae6e87e9a33f54bf537139d0b31390241d1de000ffe82bd55c9f7bbd8f" }, { "name": "streaming_data_entities_common_data_0_assets_all.apk", "sha256": "47a5fe9ca1613960048943dd5ec4ad0eec2323b0019f5ffc51ea1ece52b79705" }, { "name": "streaming_data_entities_farlands_0_assets_all.apk", "sha256": "499a16be8f11c351398030cef2d10889f0780ad17ded20c44d97a243d8f90f9e" }, { "name": "streaming_data_entities_husbandry_0_assets_all.apk", "sha256": "b4aae7d89c1d3dba94412d254a1218caa91b59c556cd830e4d3293c6530c9df6" }, { "name": "streaming_data_entities_husbandry_1_assets_all.apk", "sha256": "e9bb6325f8818d2bc5989e9067fd3b5dd6cb7d5e0693e5ee7359b8c62124f4ef" }, { "name": "streaming_data_entities_industrial_0_assets_all.apk", "sha256": "1365832d50c7735feb05bf61fe0217f128aca5ec8633120a40857bd43f819562" }, { "name": "streaming_data_entities_midtown_0_assets_all.apk", "sha256": "cde7d8c7478060440a5a59b863d084a6ca3e5b0c3cef1ba6cda4a26635812c70" }, { "name": "streaming_data_entities_midtown_1_assets_all.apk", "sha256": "579e3c689dd1d55c49a07e329e0cb9e0c80fddb8ff90c294d8a34539793fd51c" }, { "name": "streaming_data_entities_mountain_d_0_assets_all.apk", "sha256": "920762ccd68ee42de93e5ae272a8d2738b538465a74a6b46a907bab0ba643d94" }, { "name": "streaming_data_entities_mountain_d_1_assets_all.apk", "sha256": "7ffe3c0260a5378ee2db3ba47bb956b2e1642a257fa21396049d7e58b0b1f816" }, { "name": "streaming_data_entities_mountain_d_2_assets_all.apk", "sha256": "355f42e0d0a4609b0ddffdeef22023f07d35a32b6e4b5d7f7fce9fd29c417346" }, { "name": "streaming_data_entities_port_0_assets_all.apk", "sha256": "ddc9a9733494775990438d9c623ed3e11b22b7551cb87708e0110b701dd96b4e" }, { "name": "streaming_data_entities_race_tracks_0_assets_all.apk", "sha256": "8a1f0c56ab395a3d8dfa0938beed7d353c1820bbadef600fc8e09485cccb2a1b" }, { "name": "streaming_data_entities_styling_int_0_assets_all.apk", "sha256": "c9c7c434e19ecf13d0ce92f147af37d9710d6f781b769b514952ac047f68c6fd" }, { "name": "streaming_data_entities_sunset_speedway_0_assets_all.apk", "sha256": "148f4f0febdf78388917b630dbb99bcc1fa57f0fcfb57d4731abb18044d295fd" }, { "name": "streaming_data_entities_sunset_speedway_1_assets_all.apk", "sha256": "0def5ecd367e6388b693e943d43b09d69de1a00d049d29c227e87edb3538e512" }, { "name": "streaming_data_entities_tuning_int_0_assets_all.apk", "sha256": "f4aa49da919547fbf7f037ec7a34938293de9a0094ece6e7ac9d175a751a5fa9" }, { "name": "streaming_data_farlands_bundle_0_assets_all.apk", "sha256": "6ea766143d4843eb8c8b9f9513b8bb61d4a736224f19de6b4d8f75102f8dd8ce" }, { "name": "streaming_data_husbandry_bundle_0_assets_all.apk", "sha256": "f1e24de859750f24242bf680a6b8b4e235a385e7f68ebb00b7f33a4edabc0da3" }, { "name": "streaming_data_husbandry_bundle_1_assets_all.apk", "sha256": "a028571aaf05e641df510a1e017d809e658a866d8a77ba04242a18352aa463b2" }, { "name": "streaming_data_husbandry_bundle_2_assets_all.apk", "sha256": "447ec3f5ff5235719cf1978c5e0728d79bb76f98880700eba8d4a4b78dc6b571" }, { "name": "streaming_data_industrial_bundle_0_assets_all.apk", "sha256": "ada3c6fc09d1ae93710eed17163abcc805f2bb648fd2724004679449b33693df" }, { "name": "streaming_data_midtown_bundle_0_assets_all.apk", "sha256": "6405e662323c531306d47c5398e478bf5db94f3c4a3228c686677af7ecad2715" }, { "name": "streaming_data_midtown_bundle_1_assets_all.apk", "sha256": "1488968d6dd5d7714381a9d1dd79d12a0c0e1de7f3305d88fd837e0c66460a72" }, { "name": "textures_assets_all.apk", "sha256": "40519074e83824f2806c0aa615d20e8b3b58d76cf41ef05a0567e820956c7e0b" }, { "name": "vinyls_textures_assets_all.apk", "sha256": "d5f18f17fd3d69e6e6e10c2787e4b388eeece9a24630578387a741f9f513603a" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "dc96f428f843d3cad187390ec3475efdaef92dc317579251842f453f21e4dc87", "schema": "apk-scanner.coverage/v1", "framework": "OWASP MASVS v2", "disclaimer": "Static, metadata-only analysis. Each control is scored evidence-for / gap-signal / requires-manual-testing. This is evidence toward a MASVS assessment, NOT a certification — apk-scanner.com is not an authorized assessment lab. Absence of a static finding does not prove a control passes.", "rows": [ { "control": "MASVS-STORAGE-1", "category": "STORAGE", "title": "The app securely stores sensitive data.", "static": "partial", "status": "gap-detected", "count": 2, "findings": [ { "finding_type": 20, "key": "google_api_key", "title": "Google API key (client-shipped; restriction unverified)", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 798 ] }, { "finding_type": 20, "key": "google_api_key", "title": "Google API key (client-shipped; restriction unverified)", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 798 ] } ] }, { "control": "MASVS-STORAGE-2", "category": "STORAGE", "title": "The app prevents leakage of sensitive data.", "static": "partial", "status": "verified-exposure", "count": 5, "findings": [ { "finding_type": 1, "key": "s3_bucket", "title": "Amazon S3 bucket reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 1, "key": "s3_bucket", "title": "Amazon S3 bucket reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 1, "key": "s3_bucket", "title": "Amazon S3 bucket reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 53, "key": "firebase_storage", "title": "Firebase Storage bucket reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 72, "key": "sentry_dsn", "title": "Sentry DSN", "severity": "low", "verified": false, "relationship": "informational", "cwe": [ 200 ] } ] }, { "control": "MASVS-CRYPTO-1", "category": "CRYPTO", "title": "The app employs current strong cryptography and uses it according to best practices.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-CRYPTO-2", "category": "CRYPTO", "title": "The app performs key management according to best practices.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-AUTH-1", "category": "AUTH", "title": "The app uses secure authentication and authorization protocols.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-AUTH-2", "category": "AUTH", "title": "The app performs local authentication securely.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-AUTH-3", "category": "AUTH", "title": "The app secures sensitive operations with additional authentication.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-NETWORK-1", "category": "NETWORK", "title": "The app secures all network traffic according to current best practices.", "static": "yes", "status": "gap-detected", "count": 1, "findings": [ { "finding_type": 34, "key": "cleartext_traffic", "title": "Cleartext (HTTP) traffic permitted", "severity": "medium", "verified": false, "relationship": "gap-confirmed", "cwe": [ 319 ] } ] }, { "control": "MASVS-NETWORK-2", "category": "NETWORK", "title": "The app verifies the identity of the remote endpoint (e.g. certificate pinning).", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PLATFORM-1", "category": "PLATFORM", "title": "The app uses IPC mechanisms securely.", "static": "yes", "status": "gap-detected", "count": 1, "findings": [ { "finding_type": 35, "key": "exported_provider", "title": "Exported content provider without permission (third-party library artifact, shared across 232 unrelated developers)", "severity": "low", "verified": false, "relationship": "gap-confirmed", "cwe": [ 926, 284 ] } ] }, { "control": "MASVS-PLATFORM-2", "category": "PLATFORM", "title": "The app uses WebViews securely.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PLATFORM-3", "category": "PLATFORM", "title": "The app uses the user interface securely.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-CODE-1", "category": "CODE", "title": "The app requires an up-to-date platform version.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-CODE-2", "category": "CODE", "title": "The app has a mechanism for enforcing updates.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-CODE-3", "category": "CODE", "title": "The app only uses software components without known vulnerabilities.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-CODE-4", "category": "CODE", "title": "The app validates and sanitizes all untrusted inputs and follows secure-coding practice.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-1", "category": "RESILIENCE", "title": "The app validates the integrity of the platform.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-2", "category": "RESILIENCE", "title": "The app implements anti-tampering mechanisms.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-3", "category": "RESILIENCE", "title": "The app implements anti-static-analysis mechanisms.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-4", "category": "RESILIENCE", "title": "The app implements anti-dynamic-analysis techniques.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-1", "category": "PRIVACY", "title": "The app minimizes access to sensitive data and resources.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-2", "category": "PRIVACY", "title": "The app prevents identification of the user.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-3", "category": "PRIVACY", "title": "The app is transparent about data collection and usage.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-4", "category": "PRIVACY", "title": "The app offers user control over their data.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] } ], "categories": [ { "category": "STORAGE", "controls": 2, "gaps": 2, "verified": 1, "manual": 0 }, { "category": "CRYPTO", "controls": 2, "gaps": 0, "verified": 0, "manual": 0 }, { "category": "AUTH", "controls": 3, "gaps": 0, "verified": 0, "manual": 3 }, { "category": "NETWORK", "controls": 2, "gaps": 1, "verified": 0, "manual": 0 }, { "category": "PLATFORM", "controls": 3, "gaps": 1, "verified": 0, "manual": 1 }, { "category": "CODE", "controls": 4, "gaps": 0, "verified": 0, "manual": 1 }, { "category": "RESILIENCE", "controls": 4, "gaps": 0, "verified": 0, "manual": 4 }, { "category": "PRIVACY", "controls": 4, "gaps": 0, "verified": 0, "manual": 1 } ] }