{
  "capsule": {
    "schema": "apk-scanner.proof/v2",
    "issuer": "apk-scanner.com",
    "issued_at": "2026-10-14T11:14:45.901Z",
    "app": {
      "app_id": "com.carxtech.sr",
      "title": "CarX Street",
      "version": "1.22.0"
    },
    "analysis": {
      "issues": [],
      "stages": {
        "pii": "complete",
        "sbom": "complete",
        "signing": "certificate_parsed",
        "strings": "complete",
        "manifest": "complete"
      },
      "status": "complete",
      "grading": {
        "policy": "static-coverage-v1",
        "blockers": [],
        "eligible": true
      },
      "timings_ms": {
        "total": 235427.228,
        "harvest": 166389.94000000003,
        "detectors": 53618.74399999981
      },
      "bytes_total": 2470118820,
      "bytes_scanned": 2470118820,
      "bytes_skipped": 0,
      "files_processed": 3825,
      "coverage_version": 2,
      "string_encodings": [
        "ascii",
        "utf16le"
      ],
      "signature_validation": "not_performed"
    },
    "provenance": {
      "mode": "static",
      "artifacts": [
        {
          "name": "base.apk",
          "sha256": "dc96f428f843d3cad187390ec3475efdaef92dc317579251842f453f21e4dc87"
        },
        {
          "name": "art_assets_all.apk",
          "sha256": "4360cb5f3f461dab3259eeb0b93e7d9b05ab885e82ee7d8e5487d75c0984205d"
        },
        {
          "name": "audio_0_assets_all.apk",
          "sha256": "4df659787517c76105034d8e94498b2cf97cc7ebb723c3eb637cb7aa329daa69"
        },
        {
          "name": "cars_0_assets_all.apk",
          "sha256": "46ec0221462844143395f6e14d5d5f46a835d877979f2886358677aeffd56359"
        },
        {
          "name": "cars_1_assets_all.apk",
          "sha256": "69a2532a53c5d8bf32cf16493628a26709273f897bb999410b5eb771ca608590"
        },
        {
          "name": "cars_2_assets_all.apk",
          "sha256": "965c2fd8283462757942a1a668322f3351152cdcbe4419dd5469dc7300d33db7"
        },
        {
          "name": "cars_resources_prefabs_assets_all.apk",
          "sha256": "1a8e05a82de962e1d84886ad38e0181f78e146b9c28a1ce384efe412b05c626c"
        },
        {
          "name": "config.arm64_v8a.apk",
          "sha256": "3a8e8d6ee39b460b1d2d293c98152a3e0f8060f88d2c695ec7da9f98107071c4"
        },
        {
          "name": "resources_art_assets_all.apk",
          "sha256": "8b1081ba671d27b2bb37bc92e5d4acbef1abde7774dd536b5e46ead75540657e"
        },
        {
          "name": "resources_assets_all.apk",
          "sha256": "426ad927bee78c5b7e2ff76eb0afbb58f77ce1c11608c67a00600a2f6bbaa59f"
        },
        {
          "name": "resources_prefabs_assets_all.apk",
          "sha256": "6466a25d1bcf63c1ee90a89137f4dcfed0f79b8ecb73eeaa7fed9a07e924c90a"
        },
        {
          "name": "resources_prefabs_ui_assets_all.apk",
          "sha256": "f3bdc37c5eec5ca2d862eba0e82ad14cf24f4acf5276cd57ab5fb34f75ad7ea9"
        },
        {
          "name": "resources_ui_assets_all.apk",
          "sha256": "fb22041f7c32b9222e0d92d4b915699743d9973291bb49103e8a89b03a180c39"
        },
        {
          "name": "resources_ui_atlases_assets_all.apk",
          "sha256": "70c9f41343dcf76de7d53210131766620861f4d470f58cfc4318e07c690272a0"
        },
        {
          "name": "scenes_assets_all.apk",
          "sha256": "9b36ac7258a3c8d841048d8a5d763442af6a2839c739760ddfd4e4f8701a3394"
        },
        {
          "name": "shared_assets_all.apk",
          "sha256": "ef1c0a9e2892f6dafc1293f8d49f2c7deb9235f09a04281bd59749754446f7c4"
        },
        {
          "name": "shared_cars_assets_all.apk",
          "sha256": "f919b6bc12401ba0075b15314e453daab71a701d923c7cd9a135f182bb4dde56"
        },
        {
          "name": "shared_models_assets_all.apk",
          "sha256": "8f529ca6bca1d49ffb5d29fa1e2673474088fdf602831f49205f0638bf8c25cc"
        },
        {
          "name": "shared_prefabs_assets_all.apk",
          "sha256": "83b75110fd2bbad276156ead037062de8556cd29e55cb62a9e5dba764cf2908f"
        },
        {
          "name": "streaming_data_car_market_bundle_0_assets_all.apk",
          "sha256": "8a24e979bb14616789d823ec6e29c99b2181986e8abb11a274e46ca367b3d667"
        },
        {
          "name": "streaming_data_car_sale_bundle_0_assets_all.apk",
          "sha256": "aa90dc3fd7966aedd104003f8ed24da358158e384722f67639e791629f605f4a"
        },
        {
          "name": "streaming_data_car_showroom_bundle_0_assets_all.apk",
          "sha256": "1df3c2da09a8201e393b7bec83ffde23186065c18958c8c885c27d7e517ecc94"
        },
        {
          "name": "streaming_data_common_bundle_0_assets_all.apk",
          "sha256": "a91f0d7c4e68ee657956070298e2ce3ab35c5f4c3ad89fae490a86a356e10e5b"
        },
        {
          "name": "streaming_data_common_bundle_1_assets_all.apk",
          "sha256": "827ed69df35860365ea4a8c42a1e31f6acb65e766a37f8c7de7a32c60c3ff3d7"
        },
        {
          "name": "streaming_data_common_data_bundle_0_assets_all.apk",
          "sha256": "0341a207319c8aee3cb47f229d716ad928f4339fc468d250e3fe69d7ad2d1ea8"
        },
        {
          "name": "streaming_data_entities_0_assets_all.apk",
          "sha256": "b3255f29894f8796e520dc8284b38f534ddd2304256fc9aec183351fbee45aa0"
        },
        {
          "name": "streaming_data_entities_car_market_0_assets_all.apk",
          "sha256": "1ce06de269f897a6f9a164f6e0355b2800dd6788ab5bc2c997e6f3430fdaa9d1"
        },
        {
          "name": "streaming_data_entities_car_showroom_0_assets_all.apk",
          "sha256": "866c56e9229f14775237130e71d44a2e6782e05d486bc59d38e5af5887a891c2"
        },
        {
          "name": "streaming_data_entities_common_0_assets_all.apk",
          "sha256": "3f2ec6ae6e87e9a33f54bf537139d0b31390241d1de000ffe82bd55c9f7bbd8f"
        },
        {
          "name": "streaming_data_entities_common_data_0_assets_all.apk",
          "sha256": "47a5fe9ca1613960048943dd5ec4ad0eec2323b0019f5ffc51ea1ece52b79705"
        },
        {
          "name": "streaming_data_entities_farlands_0_assets_all.apk",
          "sha256": "499a16be8f11c351398030cef2d10889f0780ad17ded20c44d97a243d8f90f9e"
        },
        {
          "name": "streaming_data_entities_husbandry_0_assets_all.apk",
          "sha256": "b4aae7d89c1d3dba94412d254a1218caa91b59c556cd830e4d3293c6530c9df6"
        },
        {
          "name": "streaming_data_entities_husbandry_1_assets_all.apk",
          "sha256": "e9bb6325f8818d2bc5989e9067fd3b5dd6cb7d5e0693e5ee7359b8c62124f4ef"
        },
        {
          "name": "streaming_data_entities_industrial_0_assets_all.apk",
          "sha256": "1365832d50c7735feb05bf61fe0217f128aca5ec8633120a40857bd43f819562"
        },
        {
          "name": "streaming_data_entities_midtown_0_assets_all.apk",
          "sha256": "cde7d8c7478060440a5a59b863d084a6ca3e5b0c3cef1ba6cda4a26635812c70"
        },
        {
          "name": "streaming_data_entities_midtown_1_assets_all.apk",
          "sha256": "579e3c689dd1d55c49a07e329e0cb9e0c80fddb8ff90c294d8a34539793fd51c"
        },
        {
          "name": "streaming_data_entities_mountain_d_0_assets_all.apk",
          "sha256": "920762ccd68ee42de93e5ae272a8d2738b538465a74a6b46a907bab0ba643d94"
        },
        {
          "name": "streaming_data_entities_mountain_d_1_assets_all.apk",
          "sha256": "7ffe3c0260a5378ee2db3ba47bb956b2e1642a257fa21396049d7e58b0b1f816"
        },
        {
          "name": "streaming_data_entities_mountain_d_2_assets_all.apk",
          "sha256": "355f42e0d0a4609b0ddffdeef22023f07d35a32b6e4b5d7f7fce9fd29c417346"
        },
        {
          "name": "streaming_data_entities_port_0_assets_all.apk",
          "sha256": "ddc9a9733494775990438d9c623ed3e11b22b7551cb87708e0110b701dd96b4e"
        },
        {
          "name": "streaming_data_entities_race_tracks_0_assets_all.apk",
          "sha256": "8a1f0c56ab395a3d8dfa0938beed7d353c1820bbadef600fc8e09485cccb2a1b"
        },
        {
          "name": "streaming_data_entities_styling_int_0_assets_all.apk",
          "sha256": "c9c7c434e19ecf13d0ce92f147af37d9710d6f781b769b514952ac047f68c6fd"
        },
        {
          "name": "streaming_data_entities_sunset_speedway_0_assets_all.apk",
          "sha256": "148f4f0febdf78388917b630dbb99bcc1fa57f0fcfb57d4731abb18044d295fd"
        },
        {
          "name": "streaming_data_entities_sunset_speedway_1_assets_all.apk",
          "sha256": "0def5ecd367e6388b693e943d43b09d69de1a00d049d29c227e87edb3538e512"
        },
        {
          "name": "streaming_data_entities_tuning_int_0_assets_all.apk",
          "sha256": "f4aa49da919547fbf7f037ec7a34938293de9a0094ece6e7ac9d175a751a5fa9"
        },
        {
          "name": "streaming_data_farlands_bundle_0_assets_all.apk",
          "sha256": "6ea766143d4843eb8c8b9f9513b8bb61d4a736224f19de6b4d8f75102f8dd8ce"
        },
        {
          "name": "streaming_data_husbandry_bundle_0_assets_all.apk",
          "sha256": "f1e24de859750f24242bf680a6b8b4e235a385e7f68ebb00b7f33a4edabc0da3"
        },
        {
          "name": "streaming_data_husbandry_bundle_1_assets_all.apk",
          "sha256": "a028571aaf05e641df510a1e017d809e658a866d8a77ba04242a18352aa463b2"
        },
        {
          "name": "streaming_data_husbandry_bundle_2_assets_all.apk",
          "sha256": "447ec3f5ff5235719cf1978c5e0728d79bb76f98880700eba8d4a4b78dc6b571"
        },
        {
          "name": "streaming_data_industrial_bundle_0_assets_all.apk",
          "sha256": "ada3c6fc09d1ae93710eed17163abcc805f2bb648fd2724004679449b33693df"
        },
        {
          "name": "streaming_data_midtown_bundle_0_assets_all.apk",
          "sha256": "6405e662323c531306d47c5398e478bf5db94f3c4a3228c686677af7ecad2715"
        },
        {
          "name": "streaming_data_midtown_bundle_1_assets_all.apk",
          "sha256": "1488968d6dd5d7714381a9d1dd79d12a0c0e1de7f3305d88fd837e0c66460a72"
        },
        {
          "name": "textures_assets_all.apk",
          "sha256": "40519074e83824f2806c0aa615d20e8b3b58d76cf41ef05a0567e820956c7e0b"
        },
        {
          "name": "vinyls_textures_assets_all.apk",
          "sha256": "d5f18f17fd3d69e6e6e10c2787e4b388eeece9a24630578387a741f9f513603a"
        }
      ],
      "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e"
    },
    "apk_sha256": "dc96f428f843d3cad187390ec3475efdaef92dc317579251842f453f21e4dc87",
    "scan": {
      "scan_id": "b4645c13-631c-4fcb-8e25-bb24183aac9a",
      "scanned_at": "2026-10-09T16:47:24.587Z",
      "grade": "F",
      "score": 0
    },
    "apk_signer": {
      "scheme": "v3",
      "subject_o": "Google Inc.",
      "subject_cn": "Android",
      "sha256": "44d539844e7f832f442f3f26124855c1882599df8d0ea177f3b22bb3797256ce",
      "not_after": "2052-05-18T09:11:32+00:00"
    },
    "counts": {
      "critical": 3,
      "high": 0,
      "medium": 1,
      "low": 5
    },
    "findings": [
      {
        "finding_type": 1,
        "severity": "critical",
        "title": "Amazon S3 bucket reference — confirmed publicly readable",
        "redacted_display": "https://████████.s3.us-east-1.amazonaws.com/███",
        "fingerprint": "ad5fc93f0c031b3c7c02541b473352f091393648116a7a55d2e99b59cc63018a",
        "verified": true,
        "cwe": [
          "CWE-200",
          "CWE-284"
        ],
        "masvs": [
          "MASVS-STORAGE-2"
        ],
        "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open."
      },
      {
        "finding_type": 1,
        "severity": "critical",
        "title": "Amazon S3 bucket reference — confirmed publicly readable",
        "redacted_display": "https://████████.s3.amazonaws.com/███",
        "fingerprint": "eed99eb6f4e6b575ac439b7ecc758ab86ce802013927fb5a9fb0877274498d89",
        "verified": true,
        "cwe": [
          "CWE-200",
          "CWE-284"
        ],
        "masvs": [
          "MASVS-STORAGE-2"
        ],
        "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open."
      },
      {
        "finding_type": 1,
        "severity": "critical",
        "title": "Amazon S3 bucket reference — confirmed publicly readable",
        "redacted_display": "https://████████.s3.us-east-1.amazonaws.com/███",
        "fingerprint": "a7dfb777228c78135570ccda7214ee65f8a48d89b28d457772b28dce39230d93",
        "verified": true,
        "cwe": [
          "CWE-200",
          "CWE-284"
        ],
        "masvs": [
          "MASVS-STORAGE-2"
        ],
        "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open."
      },
      {
        "finding_type": 20,
        "severity": "low",
        "title": "Google API key (client-shipped; restriction unverified)",
        "redacted_display": "AIza•••••••• (21–40 chars, redacted)",
        "fingerprint": "1db5f535de8f5544272864c2e200262eb2d5b61bf90a8a3b213bfa2680009761",
        "verified": false,
        "cwe": [
          "CWE-798"
        ],
        "masvs": [
          "MASVS-STORAGE-1"
        ],
        "remediation": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control."
      },
      {
        "finding_type": 20,
        "severity": "low",
        "title": "Google API key (client-shipped; restriction unverified)",
        "redacted_display": "AIza•••••••• (21–40 chars, redacted)",
        "fingerprint": "3f988a35391ea3fd95044d6126c91d45c9b5ea696f004f9f4c5a66dfd75a4a12",
        "verified": false,
        "cwe": [
          "CWE-798"
        ],
        "masvs": [
          "MASVS-STORAGE-1"
        ],
        "remediation": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control."
      },
      {
        "finding_type": 35,
        "severity": "low",
        "title": "Exported content provider without permission (third-party library artifact, shared across 232 unrelated developers)",
        "redacted_display": "PreloadInfoContentProvider (exported, no permission)",
        "fingerprint": "e510d1eb34e8724fb89c83162bddb9cb7decb566898c4cfb5f1fc0556fb56332",
        "verified": false,
        "cwe": [
          "CWE-926",
          "CWE-284"
        ],
        "masvs": [
          "MASVS-PLATFORM-1"
        ],
        "remediation": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly."
      },
      {
        "finding_type": 53,
        "severity": "low",
        "title": "Firebase Storage bucket reference",
        "redacted_display": "████████████",
        "fingerprint": "10483beb7bc2ee1dbcb73c83f465326c1943d8385fe50ea44b248a1ea8ee7709",
        "verified": false,
        "cwe": [
          "CWE-200",
          "CWE-284"
        ],
        "masvs": [
          "MASVS-STORAGE-2"
        ],
        "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open."
      },
      {
        "finding_type": 72,
        "severity": "low",
        "title": "Sentry DSN",
        "redacted_display": "https://███████.ingest.sentry.io/███",
        "fingerprint": "50dfbe0bfdc4d1c84ae01d3e177ef667c80e6dcdaac78e243c4793e236728c9a",
        "verified": false,
        "cwe": [
          "CWE-200"
        ],
        "masvs": [
          "MASVS-STORAGE-2"
        ],
        "remediation": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events."
      },
      {
        "finding_type": 34,
        "severity": "medium",
        "title": "Cleartext (HTTP) traffic permitted",
        "redacted_display": "android:usesCleartextTraffic=\"true\"",
        "fingerprint": "94025ca91177232efea2d52d976e37f967866402c6e01f481a8de610b8e478e7",
        "verified": false,
        "cwe": [
          "CWE-319"
        ],
        "masvs": [
          "MASVS-NETWORK-1"
        ],
        "remediation": "Set android:usesCleartextTraffic=false and/or a networkSecurityConfig that forbids cleartext; serve all endpoints over HTTPS."
      }
    ],
    "live_verification": {
      "verified_count": 3,
      "items": [
        {
          "finding_type": 1,
          "title": "Amazon S3 bucket reference — confirmed publicly readable",
          "fingerprint": "ad5fc93f0c031b3c7c02541b473352f091393648116a7a55d2e99b59cc63018a"
        },
        {
          "finding_type": 1,
          "title": "Amazon S3 bucket reference — confirmed publicly readable",
          "fingerprint": "eed99eb6f4e6b575ac439b7ecc758ab86ce802013927fb5a9fb0877274498d89"
        },
        {
          "finding_type": 1,
          "title": "Amazon S3 bucket reference — confirmed publicly readable",
          "fingerprint": "a7dfb777228c78135570ccda7214ee65f8a48d89b28d457772b28dce39230d93"
        }
      ]
    },
    "trackers_count": 18,
    "pii": {
      "sources": 3,
      "identifiers": [
        "Advertising ID (AAID)",
        "Android ID",
        "Device ID / IMEI"
      ],
      "destinations": 15
    },
    "sbom": {
      "component_count": 47,
      "vuln_count": 0,
      "components": [
        {
          "name": "androidx.activity:activity",
          "version": "1.7.1",
          "cves": []
        },
        {
          "name": "androidx.activity:activity-ktx",
          "version": "1.7.1",
          "cves": []
        },
        {
          "name": "androidx.annotation:annotation-experimental",
          "version": "1.4.0",
          "cves": []
        },
        {
          "name": "androidx.appcompat:appcompat",
          "version": "1.2.0",
          "cves": []
        },
        {
          "name": "androidx.appcompat:appcompat-resources",
          "version": "1.2.0",
          "cves": []
        },
        {
          "name": "androidx.browser:browser",
          "version": "1.8.0",
          "cves": []
        },
        {
          "name": "androidx.core:core",
          "version": "1.9.0",
          "cves": []
        },
        {
          "name": "androidx.core:core-ktx",
          "version": "1.9.0",
          "cves": []
        },
        {
          "name": "androidx.cursoradapter:cursoradapter",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.customview:customview",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.datastore:datastore",
          "version": "1.1.3",
          "cves": []
        },
        {
          "name": "androidx.datastore:datastore-core",
          "version": "1.1.3",
          "cves": []
        },
        {
          "name": "androidx.datastore:datastore-preferences",
          "version": "1.1.3",
          "cves": []
        },
        {
          "name": "androidx.documentfile:documentfile",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.drawerlayout:drawerlayout",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.exifinterface:exifinterface",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.fragment:fragment",
          "version": "1.1.0",
          "cves": []
        },
        {
          "name": "androidx.interpolator:interpolator",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.legacy:legacy-support-core-utils",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.loader:loader",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.localbroadcastmanager:localbroadcastmanager",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.print:print",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.privacysandbox.ads:ads-adservices",
          "version": "1.1.0-beta11",
          "cves": []
        },
        {
          "name": "androidx.privacysandbox.ads:ads-adservices-java",
          "version": "1.1.0-beta11",
          "cves": []
        },
        {
          "name": "androidx.profileinstaller:profileinstaller",
          "version": "1.3.0",
          "cves": []
        },
        {
          "name": "androidx.recyclerview:recyclerview",
          "version": "1.2.1",
          "cves": []
        },
        {
          "name": "androidx.room:room-runtime",
          "version": "2.2.5",
          "cves": []
        },
        {
          "name": "androidx.savedstate:savedstate",
          "version": "1.2.1",
          "cves": []
        },
        {
          "name": "androidx.savedstate:savedstate-ktx",
          "version": "1.2.1",
          "cves": []
        },
        {
          "name": "androidx.sqlite:sqlite",
          "version": "2.1.0",
          "cves": []
        },
        {
          "name": "androidx.sqlite:sqlite-framework",
          "version": "2.1.0",
          "cves": []
        },
        {
          "name": "androidx.startup:startup-runtime",
          "version": "1.1.1",
          "cves": []
        },
        {
          "name": "androidx.tracing:tracing",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.vectordrawable:vectordrawable",
          "version": "1.1.0",
          "cves": []
        },
        {
          "name": "androidx.vectordrawable:vectordrawable-animated",
          "version": "1.1.0",
          "cves": []
        },
        {
          "name": "androidx.versionedparcelable:versionedparcelable",
          "version": "1.1.1",
          "cves": []
        },
        {
          "name": "androidx.viewpager:viewpager",
          "version": "1.0.0",
          "cves": []
        },
        {
          "name": "androidx.webkit:webkit",
          "version": "1.11.0-alpha02",
          "cves": []
        },
        {
          "name": "androidx.work:work-runtime",
          "version": "2.7.1",
          "cves": []
        },
        {
          "name": "androidx.work:work-runtime-ktx",
          "version": "2.7.0",
          "cves": []
        },
        {
          "name": "com.google.play.assetdelivery",
          "version": "1.9.1#1",
          "cves": []
        },
        {
          "name": "com.google.play.integrity",
          "version": "1.4.1#2",
          "cves": []
        },
        {
          "name": "com.google.play.review",
          "version": "1.8.4#2",
          "cves": []
        },
        {
          "name": "com.squareup.okhttp3:okhttp",
          "version": "4.11.0",
          "cves": []
        },
        {
          "name": "kotlinx:coroutines_android",
          "version": "1.7.3",
          "cves": []
        },
        {
          "name": "kotlinx:coroutines_core",
          "version": "1.7.3",
          "cves": []
        },
        {
          "name": "kotlinx:coroutines_play_services",
          "version": "1.7.3",
          "cves": []
        }
      ]
    },
    "control_coverage": {
      "schema": "apk-scanner.coverage/v1",
      "framework": "OWASP MASVS v2",
      "disclaimer": "Static, metadata-only analysis. Each control is scored evidence-for / gap-signal / requires-manual-testing. This is evidence toward a MASVS assessment, NOT a certification — apk-scanner.com is not an authorized assessment lab. Absence of a static finding does not prove a control passes.",
      "rows": [
        {
          "control": "MASVS-STORAGE-1",
          "category": "STORAGE",
          "title": "The app securely stores sensitive data.",
          "static": "partial",
          "status": "gap-detected",
          "count": 2,
          "findings": [
            {
              "finding_type": 20,
              "key": "google_api_key",
              "title": "Google API key (client-shipped; restriction unverified)",
              "severity": "low",
              "verified": false,
              "relationship": "gap-signal",
              "cwe": [
                798
              ]
            },
            {
              "finding_type": 20,
              "key": "google_api_key",
              "title": "Google API key (client-shipped; restriction unverified)",
              "severity": "low",
              "verified": false,
              "relationship": "gap-signal",
              "cwe": [
                798
              ]
            }
          ]
        },
        {
          "control": "MASVS-STORAGE-2",
          "category": "STORAGE",
          "title": "The app prevents leakage of sensitive data.",
          "static": "partial",
          "status": "verified-exposure",
          "count": 5,
          "findings": [
            {
              "finding_type": 1,
              "key": "s3_bucket",
              "title": "Amazon S3 bucket reference — confirmed publicly readable",
              "severity": "critical",
              "verified": true,
              "relationship": "verified-exposure",
              "cwe": [
                200,
                284
              ]
            },
            {
              "finding_type": 1,
              "key": "s3_bucket",
              "title": "Amazon S3 bucket reference — confirmed publicly readable",
              "severity": "critical",
              "verified": true,
              "relationship": "verified-exposure",
              "cwe": [
                200,
                284
              ]
            },
            {
              "finding_type": 1,
              "key": "s3_bucket",
              "title": "Amazon S3 bucket reference — confirmed publicly readable",
              "severity": "critical",
              "verified": true,
              "relationship": "verified-exposure",
              "cwe": [
                200,
                284
              ]
            },
            {
              "finding_type": 53,
              "key": "firebase_storage",
              "title": "Firebase Storage bucket reference",
              "severity": "low",
              "verified": false,
              "relationship": "gap-signal",
              "cwe": [
                200,
                284
              ]
            },
            {
              "finding_type": 72,
              "key": "sentry_dsn",
              "title": "Sentry DSN",
              "severity": "low",
              "verified": false,
              "relationship": "informational",
              "cwe": [
                200
              ]
            }
          ]
        },
        {
          "control": "MASVS-CRYPTO-1",
          "category": "CRYPTO",
          "title": "The app employs current strong cryptography and uses it according to best practices.",
          "static": "partial",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-CRYPTO-2",
          "category": "CRYPTO",
          "title": "The app performs key management according to best practices.",
          "static": "partial",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-AUTH-1",
          "category": "AUTH",
          "title": "The app uses secure authentication and authorization protocols.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-AUTH-2",
          "category": "AUTH",
          "title": "The app performs local authentication securely.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-AUTH-3",
          "category": "AUTH",
          "title": "The app secures sensitive operations with additional authentication.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-NETWORK-1",
          "category": "NETWORK",
          "title": "The app secures all network traffic according to current best practices.",
          "static": "yes",
          "status": "gap-detected",
          "count": 1,
          "findings": [
            {
              "finding_type": 34,
              "key": "cleartext_traffic",
              "title": "Cleartext (HTTP) traffic permitted",
              "severity": "medium",
              "verified": false,
              "relationship": "gap-confirmed",
              "cwe": [
                319
              ]
            }
          ]
        },
        {
          "control": "MASVS-NETWORK-2",
          "category": "NETWORK",
          "title": "The app verifies the identity of the remote endpoint (e.g. certificate pinning).",
          "static": "partial",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-PLATFORM-1",
          "category": "PLATFORM",
          "title": "The app uses IPC mechanisms securely.",
          "static": "yes",
          "status": "gap-detected",
          "count": 1,
          "findings": [
            {
              "finding_type": 35,
              "key": "exported_provider",
              "title": "Exported content provider without permission (third-party library artifact, shared across 232 unrelated developers)",
              "severity": "low",
              "verified": false,
              "relationship": "gap-confirmed",
              "cwe": [
                926,
                284
              ]
            }
          ]
        },
        {
          "control": "MASVS-PLATFORM-2",
          "category": "PLATFORM",
          "title": "The app uses WebViews securely.",
          "static": "partial",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-PLATFORM-3",
          "category": "PLATFORM",
          "title": "The app uses the user interface securely.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-CODE-1",
          "category": "CODE",
          "title": "The app requires an up-to-date platform version.",
          "static": "yes",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-CODE-2",
          "category": "CODE",
          "title": "The app has a mechanism for enforcing updates.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-CODE-3",
          "category": "CODE",
          "title": "The app only uses software components without known vulnerabilities.",
          "static": "yes",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-CODE-4",
          "category": "CODE",
          "title": "The app validates and sanitizes all untrusted inputs and follows secure-coding practice.",
          "static": "partial",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-RESILIENCE-1",
          "category": "RESILIENCE",
          "title": "The app validates the integrity of the platform.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-RESILIENCE-2",
          "category": "RESILIENCE",
          "title": "The app implements anti-tampering mechanisms.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-RESILIENCE-3",
          "category": "RESILIENCE",
          "title": "The app implements anti-static-analysis mechanisms.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-RESILIENCE-4",
          "category": "RESILIENCE",
          "title": "The app implements anti-dynamic-analysis techniques.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-PRIVACY-1",
          "category": "PRIVACY",
          "title": "The app minimizes access to sensitive data and resources.",
          "static": "yes",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-PRIVACY-2",
          "category": "PRIVACY",
          "title": "The app prevents identification of the user.",
          "static": "yes",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-PRIVACY-3",
          "category": "PRIVACY",
          "title": "The app is transparent about data collection and usage.",
          "static": "yes",
          "status": "no-static-findings",
          "count": 0,
          "findings": []
        },
        {
          "control": "MASVS-PRIVACY-4",
          "category": "PRIVACY",
          "title": "The app offers user control over their data.",
          "static": "manual",
          "status": "requires-manual-testing",
          "count": 0,
          "findings": []
        }
      ],
      "categories": [
        {
          "category": "STORAGE",
          "controls": 2,
          "gaps": 2,
          "verified": 1,
          "manual": 0
        },
        {
          "category": "CRYPTO",
          "controls": 2,
          "gaps": 0,
          "verified": 0,
          "manual": 0
        },
        {
          "category": "AUTH",
          "controls": 3,
          "gaps": 0,
          "verified": 0,
          "manual": 3
        },
        {
          "category": "NETWORK",
          "controls": 2,
          "gaps": 1,
          "verified": 0,
          "manual": 0
        },
        {
          "category": "PLATFORM",
          "controls": 3,
          "gaps": 1,
          "verified": 0,
          "manual": 1
        },
        {
          "category": "CODE",
          "controls": 4,
          "gaps": 0,
          "verified": 0,
          "manual": 1
        },
        {
          "category": "RESILIENCE",
          "controls": 4,
          "gaps": 0,
          "verified": 0,
          "manual": 4
        },
        {
          "category": "PRIVACY",
          "controls": 4,
          "gaps": 0,
          "verified": 0,
          "manual": 1
        }
      ]
    }
  },
  "proof": {
    "alg": "ed25519",
    "key_id": "IE6LeZNX4dAAPLGr",
    "digest_sha256": "b5d404ea1e4105999fc5f7439e37a9310f95c975ecaf8cabd8f8031e5232fab2",
    "signature": "jq33zgSmE/oQiDIsWJN42oIHe0NdeGoq9GJN3PU29ZJiifja//tY+uwc2FXP5GNBZlR8d+W/mwLA0Puw4kvzCQ==",
    "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAwH2fYdYB5nD0CQslDtG3FgafcJBoOX2OGoT80Woksrk=\n-----END PUBLIC KEY-----\n",
    "verify_url": "https://apk-scanner.com/verify"
  }
}