{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-1-s3_bucket", "name": "S3Bucket", "shortDescription": { "text": "Amazon S3 bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/s3_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "9.5", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-35-exported_provider", "name": "ExportedProvider", "shortDescription": { "text": "Exported ContentProvider without permission" }, "fullDescription": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "helpUri": "https://apk-scanner.com/finding/exported_provider", "help": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-926", "CWE-284", "MASVS-PLATFORM-1" ], "security-severity": "2.0", "cwe": [ "CWE-926", "CWE-284" ], "masvs": [ "MASVS-PLATFORM-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-72-sentry_dsn", "name": "SentryDsn", "shortDescription": { "text": "Sentry DSN" }, "fullDescription": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "helpUri": "https://apk-scanner.com/finding/sentry_dsn", "help": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-34-cleartext_traffic", "name": "CleartextTraffic", "shortDescription": { "text": "Cleartext (HTTP) traffic permitted" }, "fullDescription": { "text": "Set android:usesCleartextTraffic=false and/or a networkSecurityConfig that forbids cleartext; serve all endpoints over HTTPS." }, "helpUri": "https://apk-scanner.com/finding/cleartext_traffic", "help": { "text": "Set android:usesCleartextTraffic=false and/or a networkSecurityConfig that forbids cleartext; serve all endpoints over HTTPS." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "CWE-319", "MASVS-NETWORK-1" ], "security-severity": "5.0", "cwe": [ "CWE-319" ], "masvs": [ "MASVS-NETWORK-1" ] } } ] } }, "automationDetails": { "id": "apk-scanner/com.carxtech.sr/b4645c13-631c-4fcb-8e25-bb24183aac9a" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-1-s3_bucket", "level": "error", "message": { "text": "Amazon S3 bucket reference — confirmed publicly readable [live-verified]" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/bin/Data/Managed/Metadata/global-metadata.dat" } } } ], "partialFingerprints": { "apkscanFingerprint": "ad5fc93f0c031b3c7c02541b473352f091393648116a7a55d2e99b59cc63018a" }, "properties": { "severity": "critical", "verified": true, "relationship": "verified-exposure" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "error", "message": { "text": "Amazon S3 bucket reference — confirmed publicly readable [live-verified]" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/bin/Data/35cf00023b3e94dba842b74b790dd139" } } } ], "partialFingerprints": { "apkscanFingerprint": "eed99eb6f4e6b575ac439b7ecc758ab86ce802013927fb5a9fb0877274498d89" }, "properties": { "severity": "critical", "verified": true, "relationship": "verified-exposure" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "error", "message": { "text": "Amazon S3 bucket reference — confirmed publicly readable [live-verified]" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/bin/Data/Managed/Metadata/global-metadata.dat" } } } ], "partialFingerprints": { "apkscanFingerprint": "a7dfb777228c78135570ccda7214ee65f8a48d89b28d457772b28dce39230d93" }, "properties": { "severity": "critical", "verified": true, "relationship": "verified-exposure" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "1db5f535de8f5544272864c2e200262eb2d5b61bf90a8a3b213bfa2680009761" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/google-services-desktop.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "3f988a35391ea3fd95044d6126c91d45c9b5ea696f004f9f4c5a66dfd75a4a12" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "note", "message": { "text": "Exported content provider without permission (third-party library artifact, shared across 232 unrelated developers)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:ca.analytics.internal.PreloadInfoContentProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "e510d1eb34e8724fb89c83162bddb9cb7decb566898c4cfb5f1fc0556fb56332" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "10483beb7bc2ee1dbcb73c83f465326c1943d8385fe50ea44b248a1ea8ee7709" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/ad-viewer/adViewer.04f22f25.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "50dfbe0bfdc4d1c84ae01d3e177ef667c80e6dcdaac78e243c4793e236728c9a" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-34-cleartext_traffic", "level": "warning", "message": { "text": "Cleartext (HTTP) traffic permitted" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml" } } } ], "partialFingerprints": { "apkscanFingerprint": "94025ca91177232efea2d52d976e37f967866402c6e01f481a8de610b8e478e7" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-confirmed" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 235427.228, "harvest": 166389.94000000003, "detectors": 53618.74399999981 }, "bytes_total": 2470118820, "bytes_scanned": 2470118820, "bytes_skipped": 0, "files_processed": 3825, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "dc96f428f843d3cad187390ec3475efdaef92dc317579251842f453f21e4dc87" }, { "name": "art_assets_all.apk", "sha256": "4360cb5f3f461dab3259eeb0b93e7d9b05ab885e82ee7d8e5487d75c0984205d" }, { "name": "audio_0_assets_all.apk", "sha256": "4df659787517c76105034d8e94498b2cf97cc7ebb723c3eb637cb7aa329daa69" }, { "name": "cars_0_assets_all.apk", "sha256": "46ec0221462844143395f6e14d5d5f46a835d877979f2886358677aeffd56359" }, { "name": "cars_1_assets_all.apk", "sha256": "69a2532a53c5d8bf32cf16493628a26709273f897bb999410b5eb771ca608590" }, { "name": "cars_2_assets_all.apk", "sha256": "965c2fd8283462757942a1a668322f3351152cdcbe4419dd5469dc7300d33db7" }, { "name": "cars_resources_prefabs_assets_all.apk", "sha256": "1a8e05a82de962e1d84886ad38e0181f78e146b9c28a1ce384efe412b05c626c" }, { "name": "config.arm64_v8a.apk", "sha256": "3a8e8d6ee39b460b1d2d293c98152a3e0f8060f88d2c695ec7da9f98107071c4" }, { "name": "resources_art_assets_all.apk", "sha256": "8b1081ba671d27b2bb37bc92e5d4acbef1abde7774dd536b5e46ead75540657e" }, { "name": "resources_assets_all.apk", "sha256": "426ad927bee78c5b7e2ff76eb0afbb58f77ce1c11608c67a00600a2f6bbaa59f" }, { "name": "resources_prefabs_assets_all.apk", "sha256": "6466a25d1bcf63c1ee90a89137f4dcfed0f79b8ecb73eeaa7fed9a07e924c90a" }, { "name": "resources_prefabs_ui_assets_all.apk", "sha256": "f3bdc37c5eec5ca2d862eba0e82ad14cf24f4acf5276cd57ab5fb34f75ad7ea9" }, { "name": "resources_ui_assets_all.apk", "sha256": "fb22041f7c32b9222e0d92d4b915699743d9973291bb49103e8a89b03a180c39" }, { "name": "resources_ui_atlases_assets_all.apk", "sha256": "70c9f41343dcf76de7d53210131766620861f4d470f58cfc4318e07c690272a0" }, { "name": "scenes_assets_all.apk", "sha256": "9b36ac7258a3c8d841048d8a5d763442af6a2839c739760ddfd4e4f8701a3394" }, { "name": "shared_assets_all.apk", "sha256": "ef1c0a9e2892f6dafc1293f8d49f2c7deb9235f09a04281bd59749754446f7c4" }, { "name": "shared_cars_assets_all.apk", "sha256": "f919b6bc12401ba0075b15314e453daab71a701d923c7cd9a135f182bb4dde56" }, { "name": "shared_models_assets_all.apk", "sha256": "8f529ca6bca1d49ffb5d29fa1e2673474088fdf602831f49205f0638bf8c25cc" }, { "name": "shared_prefabs_assets_all.apk", "sha256": "83b75110fd2bbad276156ead037062de8556cd29e55cb62a9e5dba764cf2908f" }, { "name": "streaming_data_car_market_bundle_0_assets_all.apk", "sha256": "8a24e979bb14616789d823ec6e29c99b2181986e8abb11a274e46ca367b3d667" }, { "name": "streaming_data_car_sale_bundle_0_assets_all.apk", "sha256": "aa90dc3fd7966aedd104003f8ed24da358158e384722f67639e791629f605f4a" }, { "name": "streaming_data_car_showroom_bundle_0_assets_all.apk", "sha256": "1df3c2da09a8201e393b7bec83ffde23186065c18958c8c885c27d7e517ecc94" }, { "name": "streaming_data_common_bundle_0_assets_all.apk", "sha256": "a91f0d7c4e68ee657956070298e2ce3ab35c5f4c3ad89fae490a86a356e10e5b" }, { "name": "streaming_data_common_bundle_1_assets_all.apk", "sha256": "827ed69df35860365ea4a8c42a1e31f6acb65e766a37f8c7de7a32c60c3ff3d7" }, { "name": "streaming_data_common_data_bundle_0_assets_all.apk", "sha256": "0341a207319c8aee3cb47f229d716ad928f4339fc468d250e3fe69d7ad2d1ea8" }, { "name": "streaming_data_entities_0_assets_all.apk", "sha256": "b3255f29894f8796e520dc8284b38f534ddd2304256fc9aec183351fbee45aa0" }, { "name": "streaming_data_entities_car_market_0_assets_all.apk", "sha256": "1ce06de269f897a6f9a164f6e0355b2800dd6788ab5bc2c997e6f3430fdaa9d1" }, { "name": "streaming_data_entities_car_showroom_0_assets_all.apk", "sha256": "866c56e9229f14775237130e71d44a2e6782e05d486bc59d38e5af5887a891c2" }, { "name": "streaming_data_entities_common_0_assets_all.apk", "sha256": "3f2ec6ae6e87e9a33f54bf537139d0b31390241d1de000ffe82bd55c9f7bbd8f" }, { "name": "streaming_data_entities_common_data_0_assets_all.apk", "sha256": "47a5fe9ca1613960048943dd5ec4ad0eec2323b0019f5ffc51ea1ece52b79705" }, { "name": "streaming_data_entities_farlands_0_assets_all.apk", "sha256": "499a16be8f11c351398030cef2d10889f0780ad17ded20c44d97a243d8f90f9e" }, { "name": "streaming_data_entities_husbandry_0_assets_all.apk", "sha256": "b4aae7d89c1d3dba94412d254a1218caa91b59c556cd830e4d3293c6530c9df6" }, { "name": "streaming_data_entities_husbandry_1_assets_all.apk", "sha256": "e9bb6325f8818d2bc5989e9067fd3b5dd6cb7d5e0693e5ee7359b8c62124f4ef" }, { "name": "streaming_data_entities_industrial_0_assets_all.apk", "sha256": "1365832d50c7735feb05bf61fe0217f128aca5ec8633120a40857bd43f819562" }, { "name": "streaming_data_entities_midtown_0_assets_all.apk", "sha256": "cde7d8c7478060440a5a59b863d084a6ca3e5b0c3cef1ba6cda4a26635812c70" }, { "name": "streaming_data_entities_midtown_1_assets_all.apk", "sha256": "579e3c689dd1d55c49a07e329e0cb9e0c80fddb8ff90c294d8a34539793fd51c" }, { "name": "streaming_data_entities_mountain_d_0_assets_all.apk", "sha256": "920762ccd68ee42de93e5ae272a8d2738b538465a74a6b46a907bab0ba643d94" }, { "name": "streaming_data_entities_mountain_d_1_assets_all.apk", "sha256": "7ffe3c0260a5378ee2db3ba47bb956b2e1642a257fa21396049d7e58b0b1f816" }, { "name": "streaming_data_entities_mountain_d_2_assets_all.apk", "sha256": "355f42e0d0a4609b0ddffdeef22023f07d35a32b6e4b5d7f7fce9fd29c417346" }, { "name": "streaming_data_entities_port_0_assets_all.apk", "sha256": "ddc9a9733494775990438d9c623ed3e11b22b7551cb87708e0110b701dd96b4e" }, { "name": "streaming_data_entities_race_tracks_0_assets_all.apk", "sha256": "8a1f0c56ab395a3d8dfa0938beed7d353c1820bbadef600fc8e09485cccb2a1b" }, { "name": "streaming_data_entities_styling_int_0_assets_all.apk", "sha256": "c9c7c434e19ecf13d0ce92f147af37d9710d6f781b769b514952ac047f68c6fd" }, { "name": "streaming_data_entities_sunset_speedway_0_assets_all.apk", "sha256": "148f4f0febdf78388917b630dbb99bcc1fa57f0fcfb57d4731abb18044d295fd" }, { "name": "streaming_data_entities_sunset_speedway_1_assets_all.apk", "sha256": "0def5ecd367e6388b693e943d43b09d69de1a00d049d29c227e87edb3538e512" }, { "name": "streaming_data_entities_tuning_int_0_assets_all.apk", "sha256": "f4aa49da919547fbf7f037ec7a34938293de9a0094ece6e7ac9d175a751a5fa9" }, { "name": "streaming_data_farlands_bundle_0_assets_all.apk", "sha256": "6ea766143d4843eb8c8b9f9513b8bb61d4a736224f19de6b4d8f75102f8dd8ce" }, { "name": "streaming_data_husbandry_bundle_0_assets_all.apk", "sha256": "f1e24de859750f24242bf680a6b8b4e235a385e7f68ebb00b7f33a4edabc0da3" }, { "name": "streaming_data_husbandry_bundle_1_assets_all.apk", "sha256": "a028571aaf05e641df510a1e017d809e658a866d8a77ba04242a18352aa463b2" }, { "name": "streaming_data_husbandry_bundle_2_assets_all.apk", "sha256": "447ec3f5ff5235719cf1978c5e0728d79bb76f98880700eba8d4a4b78dc6b571" }, { "name": "streaming_data_industrial_bundle_0_assets_all.apk", "sha256": "ada3c6fc09d1ae93710eed17163abcc805f2bb648fd2724004679449b33693df" }, { "name": "streaming_data_midtown_bundle_0_assets_all.apk", "sha256": "6405e662323c531306d47c5398e478bf5db94f3c4a3228c686677af7ecad2715" }, { "name": "streaming_data_midtown_bundle_1_assets_all.apk", "sha256": "1488968d6dd5d7714381a9d1dd79d12a0c0e1de7f3305d88fd837e0c66460a72" }, { "name": "textures_assets_all.apk", "sha256": "40519074e83824f2806c0aa615d20e8b3b58d76cf41ef05a0567e820956c7e0b" }, { "name": "vinyls_textures_assets_all.apk", "sha256": "d5f18f17fd3d69e6e6e10c2787e4b388eeece9a24630578387a741f9f513603a" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "dc96f428f843d3cad187390ec3475efdaef92dc317579251842f453f21e4dc87", "app_id": "com.carxtech.sr", "app_title": "CarX Street", "app_version": "1.22.0", "scan_id": "b4645c13-631c-4fcb-8e25-bb24183aac9a", "scanned_at": "2026-10-09T16:47:24.587Z" } } ] }