{ "capsule": { "schema": "apk-scanner.proof/v2", "issuer": "apk-scanner.com", "issued_at": "2026-10-13T16:33:37.474Z", "app": { "app_id": "com.chamberlain.android.liftmaster.myq", "title": "myQ Garage & Access Control", "version": "5.320.0.1132029" }, "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 47466.658, "harvest": 16558.129, "detectors": 26429.69099999995 }, "bytes_total": 208381819, "bytes_scanned": 208381819, "bytes_skipped": 0, "files_processed": 7320, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "d97232b68f46c875916f1d6a63daf99d5aa9402d52f4c15b9ee388d8ed7aa9e1" }, { "name": "config.arm64_v8a.apk", "sha256": "4f29fc64c463b7aa7cee5dafbde8a37b11545021a36c845da064a2dad0a8dec6" }, { "name": "config.xxhdpi.apk", "sha256": "a653b045b6f9fdba10888065ca5d4ab1d713d1bda351c82d487743c9d944cba2" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "d97232b68f46c875916f1d6a63daf99d5aa9402d52f4c15b9ee388d8ed7aa9e1", "scan": { "scan_id": "f65c5858-7836-4da8-b9fc-7bba07eff6f6", "scanned_at": "2026-10-13T07:00:35.791Z", "grade": "F", "score": 0 }, "apk_signer": { "scheme": "v3", "subject_o": "The Chamberlain Group, Inc.", "subject_cn": "Chamberlain", "sha256": "3c49834ec2790eb47233080401a5d37b354bd5ac639beeafbbef7c562005e40c", "not_after": "2039-01-14T17:48:47+00:00" }, "counts": { "critical": 48, "high": 0, "medium": 0, "low": 29 }, "findings": [ { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "55477d9f27a243f76719c72fcad75261b66edbf1eb0ebae0191b64955f3562dd", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "2a91859cbddbbd27d2b397d267556590093c0719f0e47ddb1f31036124867e8c", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "04a2fde41801f51b8735599e9e1c844d7630d03f5621a507de061bfc99f1c987", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "1a7c3ff0964bb098a6c6a5cc513ff7bb81aebbae5a9efbd6b3d49e91040b51b1", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "44bb5e9123b15b000f9925ed16a32489d45f122f2303582c84735ddf154ba36e", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "0464134a9aff04c7eb83c7bc31c63a511b9cfdf4a5e0aed2b48fcd1d66f23cdb", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "121d35f8491befc624f79e913e8476701069eba334de6b951a94a6f952abf864", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "6d266486d5ff33dce7f3dc5a8fe38ee1e9578dcaddbcc758e61fa5ee16987fea", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "50b9563f9c205c4469778a9468642f7d968669371f5c1215bccdac3c40adc0a3", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "48719d6c062ed9aa2a67d935dd09fc50b4fb883929380d83796bce8278d1afef", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "2b131e7e85665c01bdaa4a3bbf7551197e8a3f130d2f9710f4676bcab17467db", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "061aaba6a3292c683d109fa8492b6a0179834639315f9caf785095e42ea29932", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "66b4b69bb435feef2210d181c47f39fecc28733e4372823a042d5d21d46d64a9", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "06fccc697515e8ec2476f894d65007d0337ba76c23bbe4a4f2ce326346bcd84f", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8f1fe7e1e198ec35e032d9ec9e1d785db19e0b9891a838fe4fc56b2ea0f2e84d", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "885c90cbd6229990290c445f213eae8c4c6efebd240610c6fec449e9312bf05e", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "7a165eeb5f8689f2f6aa9a69d306676b6834d1d0dfd3809915a2c62501a34feb", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "331176d319d65477fc8e93e90a6548bc8af95c20e05570304cd4126f19c2add2", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "247bfac45b802fc6f70cb94691308123cad2291006dcf08875121072c53dd69d", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "eec2a112362167c8fd5eafd07a2fd0df87352887f1c2b9792b392246f9466418", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "00333d99f018b7e06e1cb3e82f7497e05b4e662e2c90b2143b483df5d61740dc", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "694843e4b19c3a452f9365947c8e5f9b3ef0b99063d448269a3758846e6b7ef3", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "d370dd717cf68086e8e8303c3c1dc0cd2cf6778bc48bdb0b93b82e13841b62a6", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "c963fcfb4520dcf41d52032b85d78e727aa440065d4f155ad8fea78d4249f65f", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "ca866bc42567513bbd55908adf2f59d1987284f7c76be333ba1430887306f3b5", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "075034374d70b1c7c65407dc54e2ae02b0b6f7328157adb307b25750ea35f4b7", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "c8d04aecee3d6e7dd19b5282207d3d2d9062f7317dae3c07afca50fb365174fd", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "6dcb915f182ec230f520fcbd3fb6a942df4dd1195042437da0a0afd1112fc2b4", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "e2917aeeb4d61d9327dc4d793c24f7673499561f4c45f84a6315a56c0f0ef3ea", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "9ebd2a5f41d73ba75eadf26c2440a52bc659c4bb7b7d0567bcde0b698be134e5", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "890e1d1a64e5a716314400a5592f562599a97323500a6f35af1becf416e21802", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "0eeaf0036f21f4358c686176a273b44b78edadbe6eade2182f14591638310ca6", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "cfc7e4e2589c0939c9510de8abb68a974ea24383a8136089e68307eed815e406", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "be6122c2f9e77de96b881342fb0eb922b33d128c90ffc5ac1179169a163f7cc3", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "29a416c1685df8f67a1f773c937cf064d95c91c91302c6525051294ffbb0dca1", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "16cf08b4acadc8991d14ca0916f94f30e50304fb3c54f624bbbea80d89708e82", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "4bdaf0d494c15334a10b9fb1f8515395cbba00685920ab04f1b2f6a8367d0c6a", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "888b762dca8a4cd208e303c6b2944f54e07b358621c6659216ba794be387ab19", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "3ebcd29def798ab4164313e6421a53293488ec0b1859a142a86363604394cdc3", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "b0d9be0d3d8b1fdb8e658bc56c2f3b3b4d2a4f1e537f45507fa28743f420c647", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "6f827bdb1e845301c2b9b71f047d50f8539036d574470a4033945427775000b8", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "f5423f0fa9c42539247f99615cc64cb8fcc1c5d464936977d2808852ebd6f7ba", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "e1ff94a1027a88fae6256dee7e3b060e9ca33dcd0b1de3eceb59dfe5c11e501f", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "7d7afbcd89ce9d2a3290be6542ec56f9cf08424ff1e94bdc717ed555b41d1561", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "85e8f6f27b6bc1498854d8949d61931bc7b014403a63991f2af04e29e41d8aab", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "68d5c2444a2fb381794b8cef8664ee5925f06c162039ab3a0b19b2c3f33a533b", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "critical", "title": "Google Cloud Storage reference — confirmed publicly readable", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "4861f135ed3c924350745d05f1dc77f58e6a908c7307a9ddac8a785424071458", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 53, "severity": "critical", "title": "Firebase Storage bucket reference — confirmed publicly readable", "redacted_display": "████████████", "fingerprint": "fcfd83d528056a17e5e7890e10ea37b5ad690194c68d515817dc6920584857bd", "verified": true, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 2, "severity": "low", "title": "Firebase Realtime Database reference", "redacted_display": "https://██████████████.firebaseio.com/███", "fingerprint": "7d207caa05b0ae0d37c20bfd2665874b3b94a5775a59a4179eff2c0e549c513e", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "7e1a741b12f8c349ff4120e030a9d2553266ef895858fbc3d36ac1381f531f05", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a5d62286cfaac3684a7cf36c779ef6caf1750fa752fbc043a74d6dbdaee3a69b", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "2b9e2378fd4b6e63cd1549c028ee8fd131835b3dab4323b29e18ca6304be489f", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "eea4e7b7fbdf45245ea050fcc22a116a94b86849d06a1067cabcaa85291c4ed8", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "d1eed82b6ff0d2251b601f5fb790a69c1b2207d192018a844dfa3a5ba9f5d41c", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "5355aabda4bce2eaa98607a4851fc36dae2274048f7d4f0ab890afffb24e2d53", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "62e2ad7e84745c7b15909bcd432089bca7a4f350931f93b9138965aefe243bc1", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "6c3498afd9a8f2f4a5b290a9b655d8705380c451b8ae59240917bd154c6a9875", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "1610ef1e2e8b3fa01608c4b6fcb8ff0710468bf107e80f1ecf29233dd3b198e1", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "afb24b239d2a94615ea9f68ad49030705da54bf9d2c4e0491a1726e3f28298c3", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8bb3f205da96354492b8ba1fc169a81f7fec73892c7e967d0d21648f995233c9", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "b8e7943cc16b748f774ebb2583aee19600cbe22780251c2223971674db98ed40", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "15c08803430abccc21bcde0aab632b7bccecf6e8df8918097a3fa6517c116edc", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8f1de6cb18d4ccd689599b2d0b598b0ff25ffd381fa153932b00f55ee9f4b392", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "324b97e049d3268d5edd298c9f71caa4d235a335c5ffdd38599aa7929709812d", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "5008151767aed9e192421273e9f7ae1184c21076821394253c296984a27e8ed2", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "abd21d80da5b8668789c98db1ec468bd2a759b7bc9ea9726d6a3857b4f94fa6b", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8efb44d3350ca6844f65773ef1e0f0645eefccd0aae14204dc5efaf190dca873", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "3cde69c2c429259e5328bc3de34281040d4b07043a9671da790b32724aa15965", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "56c270414ecb45151ae7a36bbf93da9fdae53b0342d58be6923909fbec67f6f1", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "6da824a432b90bdea1ad9d5298494fae2c87207562319e141178f24e33928521", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "4d4e4e4ac3ab6f8fcb490590e08ce88fcb2a91833284611dc310cdd0a0e51c9e", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "10e78cc73e797fbf3d5769faa8e91f2d47bf82e0201e544e84f783d879e96015", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "e6f15550ab88e4160c350b1c0617f6a89f7b844908559e1c68294c2a5559ef63", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "979a94c36fc40cce57ad76677bb1340a4c9d8f737d44426255214789eb41e2d1", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 20, "severity": "low", "title": "Google API key (client-shipped; restriction unverified)", "redacted_display": "AIza•••••••• (21–40 chars, redacted)", "fingerprint": "77d56f0775b6bcc3d3eba28c6cc8230fbc2145428ace934d32e859aae5211bb4", "verified": false, "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ], "remediation": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, { "finding_type": 20, "severity": "low", "title": "Google API key (client-shipped; restriction unverified)", "redacted_display": "AIza•••••••• (21–40 chars, redacted)", "fingerprint": "7576c675d04e0085bb289d763cf68628b60ea685070483019075e180ca2bf278", "verified": false, "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ], "remediation": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, { "finding_type": 53, "severity": "low", "title": "Firebase Storage bucket reference", "redacted_display": "████████████", "fingerprint": "ceda304f9ef0fc376f75b3a7f9f9ab8d18e6b69b5b342b7f1a834e0c4a0115ce", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." } ], "live_verification": { "verified_count": 48, "items": [ { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "55477d9f27a243f76719c72fcad75261b66edbf1eb0ebae0191b64955f3562dd" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "2a91859cbddbbd27d2b397d267556590093c0719f0e47ddb1f31036124867e8c" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "04a2fde41801f51b8735599e9e1c844d7630d03f5621a507de061bfc99f1c987" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "1a7c3ff0964bb098a6c6a5cc513ff7bb81aebbae5a9efbd6b3d49e91040b51b1" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "44bb5e9123b15b000f9925ed16a32489d45f122f2303582c84735ddf154ba36e" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "0464134a9aff04c7eb83c7bc31c63a511b9cfdf4a5e0aed2b48fcd1d66f23cdb" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "121d35f8491befc624f79e913e8476701069eba334de6b951a94a6f952abf864" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "6d266486d5ff33dce7f3dc5a8fe38ee1e9578dcaddbcc758e61fa5ee16987fea" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "50b9563f9c205c4469778a9468642f7d968669371f5c1215bccdac3c40adc0a3" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "48719d6c062ed9aa2a67d935dd09fc50b4fb883929380d83796bce8278d1afef" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "2b131e7e85665c01bdaa4a3bbf7551197e8a3f130d2f9710f4676bcab17467db" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "061aaba6a3292c683d109fa8492b6a0179834639315f9caf785095e42ea29932" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "66b4b69bb435feef2210d181c47f39fecc28733e4372823a042d5d21d46d64a9" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "06fccc697515e8ec2476f894d65007d0337ba76c23bbe4a4f2ce326346bcd84f" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "8f1fe7e1e198ec35e032d9ec9e1d785db19e0b9891a838fe4fc56b2ea0f2e84d" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "885c90cbd6229990290c445f213eae8c4c6efebd240610c6fec449e9312bf05e" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "7a165eeb5f8689f2f6aa9a69d306676b6834d1d0dfd3809915a2c62501a34feb" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "331176d319d65477fc8e93e90a6548bc8af95c20e05570304cd4126f19c2add2" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "247bfac45b802fc6f70cb94691308123cad2291006dcf08875121072c53dd69d" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "eec2a112362167c8fd5eafd07a2fd0df87352887f1c2b9792b392246f9466418" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "00333d99f018b7e06e1cb3e82f7497e05b4e662e2c90b2143b483df5d61740dc" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "694843e4b19c3a452f9365947c8e5f9b3ef0b99063d448269a3758846e6b7ef3" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "d370dd717cf68086e8e8303c3c1dc0cd2cf6778bc48bdb0b93b82e13841b62a6" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "c963fcfb4520dcf41d52032b85d78e727aa440065d4f155ad8fea78d4249f65f" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "ca866bc42567513bbd55908adf2f59d1987284f7c76be333ba1430887306f3b5" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "075034374d70b1c7c65407dc54e2ae02b0b6f7328157adb307b25750ea35f4b7" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "c8d04aecee3d6e7dd19b5282207d3d2d9062f7317dae3c07afca50fb365174fd" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "6dcb915f182ec230f520fcbd3fb6a942df4dd1195042437da0a0afd1112fc2b4" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "e2917aeeb4d61d9327dc4d793c24f7673499561f4c45f84a6315a56c0f0ef3ea" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "9ebd2a5f41d73ba75eadf26c2440a52bc659c4bb7b7d0567bcde0b698be134e5" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "890e1d1a64e5a716314400a5592f562599a97323500a6f35af1becf416e21802" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "0eeaf0036f21f4358c686176a273b44b78edadbe6eade2182f14591638310ca6" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "cfc7e4e2589c0939c9510de8abb68a974ea24383a8136089e68307eed815e406" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "be6122c2f9e77de96b881342fb0eb922b33d128c90ffc5ac1179169a163f7cc3" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "29a416c1685df8f67a1f773c937cf064d95c91c91302c6525051294ffbb0dca1" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "16cf08b4acadc8991d14ca0916f94f30e50304fb3c54f624bbbea80d89708e82" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "4bdaf0d494c15334a10b9fb1f8515395cbba00685920ab04f1b2f6a8367d0c6a" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "888b762dca8a4cd208e303c6b2944f54e07b358621c6659216ba794be387ab19" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "3ebcd29def798ab4164313e6421a53293488ec0b1859a142a86363604394cdc3" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "b0d9be0d3d8b1fdb8e658bc56c2f3b3b4d2a4f1e537f45507fa28743f420c647" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "6f827bdb1e845301c2b9b71f047d50f8539036d574470a4033945427775000b8" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "f5423f0fa9c42539247f99615cc64cb8fcc1c5d464936977d2808852ebd6f7ba" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "e1ff94a1027a88fae6256dee7e3b060e9ca33dcd0b1de3eceb59dfe5c11e501f" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "7d7afbcd89ce9d2a3290be6542ec56f9cf08424ff1e94bdc717ed555b41d1561" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "85e8f6f27b6bc1498854d8949d61931bc7b014403a63991f2af04e29e41d8aab" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "68d5c2444a2fb381794b8cef8664ee5925f06c162039ab3a0b19b2c3f33a533b" }, { "finding_type": 3, "title": "Google Cloud Storage reference — confirmed publicly readable", "fingerprint": "4861f135ed3c924350745d05f1dc77f58e6a908c7307a9ddac8a785424071458" }, { "finding_type": 53, "title": "Firebase Storage bucket reference — confirmed publicly readable", "fingerprint": "fcfd83d528056a17e5e7890e10ea37b5ad690194c68d515817dc6920584857bd" } ] }, "trackers_count": 10, "pii": { "sources": 9, "identifiers": [ "Advertising ID (AAID)", "Android ID", "Device ID / IMEI", "Hardware MAC address" ], "destinations": 7 }, "sbom": { "component_count": 142, "vuln_count": 0, "components": [ { "name": "androidx.activity:activity", "version": "1.10.1", "cves": [] }, { "name": "androidx.activity:activity-compose", "version": "1.10.1", "cves": [] }, { "name": "androidx.activity:activity-ktx", "version": "1.10.1", "cves": [] }, { "name": "androidx.annotation:annotation-experimental", "version": "1.5.0", "cves": [] }, { "name": "androidx.appcompat:appcompat", "version": "1.7.0", "cves": [] }, { "name": "androidx.appcompat:appcompat-resources", "version": "1.7.0", "cves": [] }, { "name": "androidx.asynclayoutinflater:asynclayoutinflater", "version": "1.0.0", "cves": [] }, { "name": "androidx.autofill:autofill", "version": "1.0.0", "cves": [] }, { "name": "androidx.biometric:biometric", "version": "1.1.0", "cves": [] }, { "name": "androidx.browser:browser", "version": "1.8.0", "cves": [] }, { "name": "androidx.camera:camera-camera2", "version": "1.4.0", "cves": [] }, { "name": "androidx.camera:camera-core", "version": "1.4.0", "cves": [] }, { "name": "androidx.camera:camera-lifecycle", "version": "1.4.0", "cves": [] }, { "name": "androidx.camera:camera-video", "version": "1.4.0", "cves": [] }, { "name": "androidx.camera:camera-view", "version": "1.4.0", "cves": [] }, { "name": "androidx.car.app:app", "version": "1.4.0", "cves": [] }, { "name": "androidx.cardview:cardview", "version": "1.0.0", "cves": [] }, { "name": "androidx.compose.animation:animation", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.animation:animation-core", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.foundation:foundation", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.foundation:foundation-layout", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.material3:material3", "version": "1.3.1", "cves": [] }, { "name": "androidx.compose.material:material", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.material:material-icons-core", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.material:material-icons-extended", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.material:material-ripple", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.runtime:runtime", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.runtime:runtime-livedata", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.runtime:runtime-saveable", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.ui:ui", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.ui:ui-geometry", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.ui:ui-graphics", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.ui:ui-text", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.ui:ui-tooling", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.ui:ui-tooling-data", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.ui:ui-tooling-preview", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.ui:ui-unit", "version": "1.7.8", "cves": [] }, { "name": "androidx.compose.ui:ui-util", "version": "1.7.8", "cves": [] }, { "name": "androidx.constraintlayout:constraintlayout", "version": "2.2.1", "cves": [] }, { "name": "androidx.coordinatorlayout:coordinatorlayout", "version": "1.1.0", "cves": [] }, { "name": "androidx.core:core", "version": "1.16.0", "cves": [] }, { "name": "androidx.core:core-ktx", "version": "1.16.0", "cves": [] }, { "name": "androidx.core:core-viewtree", "version": "1.0.0", "cves": [] }, { "name": "androidx.credentials:credentials", "version": "1.2.0-rc01", "cves": [] }, { "name": "androidx.credentials:credentials-play-services-auth", "version": "1.2.0-rc01", "cves": [] }, { "name": "androidx.cursoradapter:cursoradapter", "version": "1.0.0", "cves": [] }, { "name": "androidx.customview:customview", "version": "1.1.0", "cves": [] }, { "name": "androidx.customview:customview-poolingcontainer", "version": "1.0.0", "cves": [] }, { "name": "androidx.databinding:library", "version": "7.3.0", "cves": [] }, { "name": "androidx.databinding:viewbinding", "version": "8.9.1", "cves": [] }, { "name": "androidx.datastore:datastore", "version": "1.1.7", "cves": [] }, { "name": "androidx.datastore:datastore-core", "version": "1.1.7", "cves": [] }, { "name": "androidx.datastore:datastore-preferences", "version": "1.1.7", "cves": [] }, { "name": "androidx.datastore:datastore-preferences-core", "version": "1.1.7", "cves": [] }, { "name": "androidx.documentfile:documentfile", "version": "1.0.0", "cves": [] }, { "name": "androidx.drawerlayout:drawerlayout", "version": "1.1.1", "cves": [] }, { "name": "androidx.dynamicanimation:dynamicanimation", "version": "1.0.0", "cves": [] }, { "name": "androidx.emoji2:emoji2", "version": "1.3.0", "cves": [] }, { "name": "androidx.emoji2:emoji2-views-helper", "version": "1.3.0", "cves": [] }, { "name": "androidx.exifinterface:exifinterface", "version": "1.4.0", "cves": [] }, { "name": "androidx.fragment:fragment", "version": "1.8.9", "cves": [] }, { "name": "androidx.fragment:fragment-ktx", "version": "1.8.9", "cves": [] }, { "name": "androidx.graphics:graphics-path", "version": "1.0.1", "cves": [] }, { "name": "androidx.hilt:hilt-navigation", "version": "1.2.0", "cves": [] }, { "name": "androidx.hilt:hilt-navigation-compose", "version": "1.2.0", "cves": [] }, { "name": "androidx.interpolator:interpolator", "version": "1.0.0", "cves": [] }, { "name": "androidx.legacy:legacy-support-core-ui", "version": "1.0.0", "cves": [] }, { "name": "androidx.legacy:legacy-support-core-utils", "version": "1.0.0", "cves": [] }, { "name": "androidx.legacy:legacy-support-v4", "version": "1.0.0", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-extensions", "version": "2.2.0", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-livedata", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-livedata-core", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-livedata-core-ktx", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-livedata-ktx", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-process", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-runtime", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-runtime-compose", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-runtime-ktx", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-service", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-viewmodel", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-viewmodel-compose", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-viewmodel-ktx", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-viewmodel-savedstate", "version": "2.8.7", "cves": [] }, { "name": "androidx.loader:loader", "version": "1.0.0", "cves": [] }, { "name": "androidx.localbroadcastmanager:localbroadcastmanager", "version": "1.1.0", "cves": [] }, { "name": "androidx.media:media", "version": "1.6.0", "cves": [] }, { "name": "androidx.metrics:metrics-performance", "version": "1.0.0-beta03", "cves": [] }, { "name": "androidx.navigation:navigation-common", "version": "2.8.8", "cves": [] }, { "name": "androidx.navigation:navigation-common-ktx", "version": "2.8.8", "cves": [] }, { "name": "androidx.navigation:navigation-compose", "version": "2.8.8", "cves": [] }, { "name": "androidx.navigation:navigation-fragment", "version": "2.8.8", "cves": [] }, { "name": "androidx.navigation:navigation-fragment-ktx", "version": "2.8.8", "cves": [] }, { "name": "androidx.navigation:navigation-runtime", "version": "2.8.8", "cves": [] }, { "name": "androidx.navigation:navigation-runtime-ktx", "version": "2.8.8", "cves": [] }, { "name": "androidx.navigation:navigation-ui", "version": "2.8.8", "cves": [] }, { "name": "androidx.navigation:navigation-ui-ktx", "version": "2.8.8", "cves": [] }, { "name": "androidx.paging:paging-common", "version": "3.3.2", "cves": [] }, { "name": "androidx.paging:paging-compose", "version": "3.3.2", "cves": [] }, { "name": "androidx.paging:paging-runtime", "version": "3.3.2", "cves": [] }, { "name": "androidx.preference:preference", "version": "1.2.0", "cves": [] }, { "name": "androidx.print:print", "version": "1.0.0", "cves": [] }, { "name": "androidx.privacysandbox.ads:ads-adservices", "version": "1.0.0-beta05", "cves": [] }, { "name": "androidx.privacysandbox.ads:ads-adservices-java", "version": "1.0.0-beta05", "cves": [] }, { "name": "androidx.profileinstaller:profileinstaller", "version": "1.4.1", "cves": [] }, { "name": "androidx.recyclerview:recyclerview", "version": "1.4.0", "cves": [] }, { "name": "androidx.room:room-ktx", "version": "2.8.1", "cves": [] }, { "name": "androidx.room:room-paging", "version": "2.8.1", "cves": [] }, { "name": "androidx.room:room-runtime", "version": "2.8.1", "cves": [] }, { "name": "androidx.savedstate:savedstate", "version": "1.2.1", "cves": [] }, { "name": "androidx.savedstate:savedstate-ktx", "version": "1.2.1", "cves": [] }, { "name": "androidx.security:security-crypto", "version": "1.1.0-alpha06", "cves": [] }, { "name": "androidx.security:security-crypto-ktx", "version": "1.1.0-alpha06", "cves": [] }, { "name": "androidx.slidingpanelayout:slidingpanelayout", "version": "1.2.0", "cves": [] }, { "name": "androidx.sqlite:sqlite", "version": "2.6.1", "cves": [] }, { "name": "androidx.sqlite:sqlite-framework", "version": "2.6.1", "cves": [] }, { "name": "androidx.startup:startup-runtime", "version": "1.2.0", "cves": [] }, { "name": "androidx.swiperefreshlayout:swiperefreshlayout", "version": "1.2.0", "cves": [] }, { "name": "androidx.test.uiautomator:uiautomator", "version": "2.3.0", "cves": [] }, { "name": "androidx.tracing:tracing", "version": "1.2.0", "cves": [] }, { "name": "androidx.tracing:tracing-ktx", "version": "1.2.0", "cves": [] }, { "name": "androidx.transition:transition", "version": "1.5.0", "cves": [] }, { "name": "androidx.vectordrawable:vectordrawable", "version": "1.1.0", "cves": [] }, { "name": "androidx.vectordrawable:vectordrawable-animated", "version": "1.1.0", "cves": [] }, { "name": "androidx.versionedparcelable:versionedparcelable", "version": "1.1.1", "cves": [] }, { "name": "androidx.viewpager2:viewpager2", "version": "1.1.0-beta02", "cves": [] }, { "name": "androidx.viewpager:viewpager", "version": "1.0.0", "cves": [] }, { "name": "androidx.webkit:webkit", "version": "1.14.0", "cves": [] }, { "name": "androidx.window.extensions.core:core", "version": "1.0.0", "cves": [] }, { "name": "androidx.window:window", "version": "1.2.0", "cves": [] }, { "name": "androidx.work:work-runtime", "version": "2.10.2", "cves": [] }, { "name": "androidx.work:work-runtime-ktx", "version": "2.10.2", "cves": [] }, { "name": "com.google.android.material:material", "version": "1.12.0", "cves": [] }, { "name": "com.google.dagger:dagger", "version": "2.56.2", "cves": [] }, { "name": "com.google.dagger:dagger-lint-aar", "version": "2.56.2", "cves": [] }, { "name": "com.google.dagger:hilt-android", "version": "2.56.2", "cves": [] }, { "name": "com.google.dagger:hilt-core", "version": "2.56.2", "cves": [] }, { "name": "com.squareup.okhttp3:okhttp", "version": "5.4.0", "cves": [] }, { "name": "kotlinx:coroutines_android", "version": "1.11.0", "cves": [] }, { "name": "kotlinx:coroutines_core", "version": "1.11.0", "cves": [] }, { "name": "kotlinx:coroutines_play_services", "version": "1.11.0", "cves": [] }, { "name": "kotlinx:coroutines_slf4j", "version": "1.11.0", "cves": [] }, { "name": "org.jetbrains.androidx.core:core-bundle", "version": "1.0.1", "cves": [] } ] }, "control_coverage": { "schema": "apk-scanner.coverage/v1", "framework": "OWASP MASVS v2", "disclaimer": "Static, metadata-only analysis. Each control is scored evidence-for / gap-signal / requires-manual-testing. This is evidence toward a MASVS assessment, NOT a certification — apk-scanner.com is not an authorized assessment lab. Absence of a static finding does not prove a control passes.", "rows": [ { "control": "MASVS-STORAGE-1", "category": "STORAGE", "title": "The app securely stores sensitive data.", "static": "partial", "status": "gap-detected", "count": 2, "findings": [ { "finding_type": 20, "key": "google_api_key", "title": "Google API key (client-shipped; restriction unverified)", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 798 ] }, { "finding_type": 20, "key": "google_api_key", "title": "Google API key (client-shipped; restriction unverified)", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 798 ] } ] }, { "control": "MASVS-STORAGE-2", "category": "STORAGE", "title": "The app prevents leakage of sensitive data.", "static": "partial", "status": "verified-exposure", "count": 75, "findings": [ { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 53, "key": "firebase_storage", "title": "Firebase Storage bucket reference — confirmed publicly readable", "severity": "critical", "verified": true, "relationship": "verified-exposure", "cwe": [ 200, 284 ] }, { "finding_type": 2, "key": "firebase_rtdb", "title": "Firebase Realtime Database reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 53, "key": "firebase_storage", "title": "Firebase Storage bucket reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] } ] }, { "control": "MASVS-CRYPTO-1", "category": "CRYPTO", "title": "The app employs current strong cryptography and uses it according to best practices.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-CRYPTO-2", "category": "CRYPTO", "title": "The app performs key management according to best practices.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-AUTH-1", "category": "AUTH", "title": "The app uses secure authentication and authorization protocols.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-AUTH-2", "category": "AUTH", "title": "The app performs local authentication securely.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-AUTH-3", "category": "AUTH", "title": "The app secures sensitive operations with additional authentication.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-NETWORK-1", "category": "NETWORK", "title": "The app secures all network traffic according to current best practices.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-NETWORK-2", "category": "NETWORK", "title": "The app verifies the identity of the remote endpoint (e.g. certificate pinning).", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PLATFORM-1", "category": "PLATFORM", "title": "The app uses IPC mechanisms securely.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PLATFORM-2", "category": "PLATFORM", "title": "The app uses WebViews securely.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PLATFORM-3", "category": "PLATFORM", "title": "The app uses the user interface securely.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-CODE-1", "category": "CODE", "title": "The app requires an up-to-date platform version.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-CODE-2", "category": "CODE", "title": "The app has a mechanism for enforcing updates.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-CODE-3", "category": "CODE", "title": "The app only uses software components without known vulnerabilities.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-CODE-4", "category": "CODE", "title": "The app validates and sanitizes all untrusted inputs and follows secure-coding practice.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-1", "category": "RESILIENCE", "title": "The app validates the integrity of the platform.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-2", "category": "RESILIENCE", "title": "The app implements anti-tampering mechanisms.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-3", "category": "RESILIENCE", "title": "The app implements anti-static-analysis mechanisms.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-4", "category": "RESILIENCE", "title": "The app implements anti-dynamic-analysis techniques.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-1", "category": "PRIVACY", "title": "The app minimizes access to sensitive data and resources.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-2", "category": "PRIVACY", "title": "The app prevents identification of the user.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-3", "category": "PRIVACY", "title": "The app is transparent about data collection and usage.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-4", "category": "PRIVACY", "title": "The app offers user control over their data.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] } ], "categories": [ { "category": "STORAGE", "controls": 2, "gaps": 2, "verified": 1, "manual": 0 }, { "category": "CRYPTO", "controls": 2, "gaps": 0, "verified": 0, "manual": 0 }, { "category": "AUTH", "controls": 3, "gaps": 0, "verified": 0, "manual": 3 }, { "category": "NETWORK", "controls": 2, "gaps": 0, "verified": 0, "manual": 0 }, { "category": "PLATFORM", "controls": 3, "gaps": 0, "verified": 0, "manual": 1 }, { "category": "CODE", "controls": 4, "gaps": 0, "verified": 0, "manual": 1 }, { "category": "RESILIENCE", "controls": 4, "gaps": 0, "verified": 0, "manual": 4 }, { "category": "PRIVACY", "controls": 4, "gaps": 0, "verified": 0, "manual": 1 } ] } }, "proof": { "alg": "ed25519", "key_id": "IE6LeZNX4dAAPLGr", "digest_sha256": "65ecea0c95d73d13b1c8c61fb95e7458dba1ed99bd86c1e7b5afa9b97b1ecfba", "signature": "axr6u8Q2/r0IMTCCyfPKPwxSAOd8wnOArHyvBOQ2mdd+pvcmw4AvIqfS+RMI45Z5NWadQizHEvqqYrqWkv66DQ==", "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAwH2fYdYB5nD0CQslDtG3FgafcJBoOX2OGoT80Woksrk=\n-----END PUBLIC KEY-----\n", "verify_url": "https://apk-scanner.com/verify" } }