Browse appsScan report

BeautyPlus-Selfie Photo Editor

PIXOCIAL TECHNOLOGY (SINGAPORE) PTE. LTD. · Build 7.47.0

com.commsource.beautyplus

Rescan app Export / share

Static analysis completeScanned 2026-10-09 05:01 UTC

Static checks identify review items, not a guarantee of safety.

Report section

Overview

Analysis recorded

8 finding categories to review

BeautyPlus-Selfie Photo Editor (com.commsource.beautyplus) scored grade A, 92 out of 100, in a static scan of version 7.47.0 on 2026-10-09. It has no high or critical findings, and 8 lower-severity finding categories across 10 occurrences. 18 tracking SDKs are present in the package, which describes what ships, not what runs or what it sends. This is static analysis of a single build: it does not observe the app running and does not establish that any data is exposed.

Finding categories810 occurrences

High / critical0Category count

Tracking SDKs18Presence, not observed traffic

Assessment score92 / 100Grade A

Start with these findings

lowAmazon S3 bucket reference1 occurrence

Interpretation & review guidance

A reference to an Amazon S3 bucket. Using cloud storage is normal — the risk exists only if the bucket allows anonymous listing/read, which requires a separate authorized assessment.

Evidence: 1 recorded occurrence in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Open in all findings Request a correction

lowData Safety label omits Location1 occurrence

Interpretation & review guidance

The app's Google Play Data Safety label omits a data category it can actually access — a permission it requests, or an advertising/device identifier it references. Under-declaring collection is a Play policy issue and a COPPA/privacy concern. This is a static signal: a requested permission is capability, not proof of collection — confirm against runtime behavior.

How often Data Safety labels disagree with the package →

Evidence: 1 recorded occurrence in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Open in all findings Request a correction

lowExported content provider without permission (third-party library artifact, shared across 403 unrelated developers)1 occurrence

Interpretation & review guidance

An exported content provider declares no permission. Other apps on the device may reach it — verify it enforces access control internally; this flags the attack surface, not a confirmed leak.

Evidence: 1 recorded occurrence in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Open in all findings Request a correction

View all 8 categories

Privacy

35 requested permissions · 4 flagged high-risk classes.

Review privacy signals →

Build & components

103 components recorded. Certificate parsing does not validate APK signature integrity.

Inspect build evidence →

Findings

8 categories · 10 occurrences. Severity totals describe categories. Expand a finding for interpretation and review guidance.

Search findingsSeverityEvidence

lowAmazon S3 bucket reference1 occurrence

Interpretation & review guidance

A reference to an Amazon S3 bucket. Using cloud storage is normal — the risk exists only if the bucket allows anonymous listing/read, which requires a separate authorized assessment.

Evidence: 1 recorded occurrence in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Evidence preview

Evidence type

Static string match

Representative location

classes12.dex

Recorded match

Pattern recorded; identifying value redacted.

Detector rule

s3_path_url

Recorded file locations

classes12.dex

1 recorded findings have inspectable metadata. Duplicate matches may share a representative location.

Review whether this belongs to intended app functionality or a bundled library. A static match does not establish runtime impact.

Preview evidence and Pro tools

Search recorded evidence and save private review notes with Pro. $99/month plus applicable tax.

Link to category Request a correction

lowData Safety label omits Location1 occurrence

Interpretation & review guidance

How often Data Safety labels disagree with the package →

Evidence: 1 recorded occurrence in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Evidence preview

Evidence type: Static string match
Representative location: data-safety:Location
Recorded match: Pattern recorded; identifying value redacted.

1 recorded findings have inspectable metadata. Duplicate matches may share a representative location.

Review whether this belongs to intended app functionality or a bundled library. A static match does not establish runtime impact.

Preview evidence and Pro tools

Search recorded evidence and save private review notes with Pro. $99/month plus applicable tax.

Link to category Request a correction

lowExported content provider without permission (third-party library artifact, shared across 403 unrelated developers)1 occurrence

Interpretation & review guidance

An exported content provider declares no permission. Other apps on the device may reach it — verify it enforces access control internally; this flags the attack surface, not a confirmed leak.

Evidence: 1 recorded occurrence in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Evidence preview

Evidence type

Parsed app configuration

Representative location

AndroidManifest.xml:com.facebook.FacebookContentProvider

Recorded match

FacebookContentProvider (exported, no permission)

Detector rule

manifest

Recorded file locations

AndroidManifest.xml:com.facebook.FacebookContentProvider

1 recorded findings have inspectable metadata. Duplicate matches may share a representative location.

Review whether this belongs to intended app functionality or a bundled library. A static match does not establish runtime impact.

Preview evidence and Pro tools

Search recorded evidence and save private review notes with Pro. $99/month plus applicable tax.

Link to category Request a correction

lowFirebase Realtime Database reference1 occurrence

Interpretation & review guidance

A Firebase Realtime Database URL. Nearly every app that uses Firebase ships one. It's only an exposure if the database rules are world-readable — that's what live verification checks.

Evidence: 1 recorded occurrence in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Evidence preview

Evidence type

Static string match

Representative location

resources.arsc

Recorded match

Pattern recorded; identifying value redacted.

Detector rule

firebase_db

Recorded file locations

resources.arsc

1 recorded findings have inspectable metadata. Duplicate matches may share a representative location.

Review whether this belongs to intended app functionality or a bundled library. A static match does not establish runtime impact.

Preview evidence and Pro tools

Search recorded evidence and save private review notes with Pro. $99/month plus applicable tax.

Link to category Request a correction

lowFirebase Storage bucket reference1 occurrence

Interpretation & review guidance

A Firebase Cloud Storage bucket reference (the default <project>.appspot.com). Storing user files here is normal — it's only an exposure if the Storage security rules allow public read/list, which live verification tests.

Evidence: 1 recorded occurrence in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Evidence preview

Evidence type

Static string match

Representative location

resources.arsc

Recorded match

Pattern recorded; identifying value redacted.

Detector rule

firebase_storage_bucket

Recorded file locations

resources.arsc

1 recorded findings have inspectable metadata. Duplicate matches may share a representative location.

Review whether this belongs to intended app functionality or a bundled library. A static match does not establish runtime impact.

Preview evidence and Pro tools

Search recorded evidence and save private review notes with Pro. $99/month plus applicable tax.

Link to category Request a correction

lowGoogle API key (client-shipped; restriction unverified)2 occurrences

Interpretation & review guidance

Android apps are designed to ship Google API keys in the client; Google restricts them by app signing certificate + enabled API. This is only a problem if the key is left unrestricted — presence alone is expected, not an exposure.

Evidence: 2 recorded occurrences in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Evidence preview

Evidence type

Static string match

Representative location

resources.arsc

Recorded match

AIza•••••••• (21–40 chars, redacted)

Detector rule

google_api_key

Recorded file locations

resources.arsc

2 recorded findings have inspectable metadata. Duplicate matches may share a representative location.

Review whether this belongs to intended app functionality or a bundled library. A static match does not establish runtime impact.

Preview evidence and Pro tools

Search recorded evidence and save private review notes with Pro. $99/month plus applicable tax.

Link to category Request a correction

lowPrivate key material (third-party library artifact, shared across 3 unrelated developers)2 occurrences

Interpretation & review guidance

A complete PEM private-key block is embedded in the app. This is a real finding worth review — but it is often a bundled library test/sample key rather than a production secret, so we flag it high and leave confirmation to you (a bare header alone no longer triggers it).

Evidence: 2 recorded occurrences in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Evidence preview

Evidence type

Static string match

Representative location

_split_config.arm64_v8a/lib/arm64-v8a/libmtcrypt.so

Recorded match

Pattern recorded; identifying value redacted.

Detector rule

private_key

Recorded file locations

_split_config.arm64_v8a/lib/arm64-v8a/libmtcrypt.so

2 recorded findings have inspectable metadata. Duplicate matches may share a representative location.

Review whether this belongs to intended app functionality or a bundled library. A static match does not establish runtime impact.

Preview evidence and Pro tools

Search recorded evidence and save private review notes with Pro. $99/month plus applicable tax.

Link to category Request a correction

lowSentry DSN1 occurrence

Interpretation & review guidance

A Sentry DSN. These are client-side by design (embedded in apps to send crash reports), so presence is expected; it only lets someone send events to the project, not read data. Low severity — included for inventory.

Evidence: 1 recorded occurrence in the analyzed APK. These are distinct stored findings, not a count of every source match.
Verification: Static detection; current reachability is not established.

Evidence preview

Evidence type

Static string match

Representative location

_split_install_time_asset_pack/assets/snapid/public/index.html

Recorded match

Pattern recorded; identifying value redacted.

Detector rule

sentry_dsn

Recorded file locations

_split_install_time_asset_pack/assets/snapid/public/index.html

1 recorded findings have inspectable metadata. Duplicate matches may share a representative location.

Review whether this belongs to intended app functionality or a bundled library. A static match does not establish runtime impact.

Preview evidence and Pro tools

Search recorded evidence and save private review notes with Pro. $99/month plus applicable tax.

Link to category Request a correction

Privacy signals

Capabilities and bundled software do not prove that data was collected or transmitted.

Requested permissions35

Flagged high-risk classes4

Detected SDKs18

Precise location Approx. location Camera Microphone

Requested permission inventory (35)

android.permission.ACCESS_ADSERVICES_AD_ID
android.permission.ACCESS_ADSERVICES_ATTRIBUTION
android.permission.ACCESS_ADSERVICES_TOPICS
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_MEDIA_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.AUTHENTICATE_ACCOUNTS
android.permission.BLUETOOTH
android.permission.CAMERA
android.permission.CHANGE_NETWORK_STATE
android.permission.FOREGROUND_SERVICE
android.permission.FOREGROUND_SERVICE_DATA_SYNC
android.permission.HIGH_SAMPLING_RATE_SENSORS
android.permission.INTERNET
android.permission.POST_NOTIFICATIONS
android.permission.READ_MEDIA_AUDIO
android.permission.READ_MEDIA_IMAGES
android.permission.READ_MEDIA_VIDEO
android.permission.READ_MEDIA_VISUAL_USER_SELECTED
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.WAKE_LOCK
com.android.vending.BILLING
com.android.vending.CHECK_LICENSE
com.asus.msa.SupplementaryDID.ACCESS
com.commsource.beautyplus.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
com.commsource.beautyplus.MT_ACCOUNT_LOGIN
com.commsource.beautyplus.permission.C2D_MESSAGE
com.google.android.c2dm.permission.RECEIVE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
com.google.android.gms.permission.AD_ID
com.google.android.providers.gsf.permission.READ_GSERVICES

Data collection & flow (privacy signal, not part of the grade)

Data the app can access

Camera

Location

Approximate locationPrecise location

Microphone

Photos & files

PhotosVideosStorageStorage (write)Audio files

Persistent identifiers (referenced in code)

Advertising ID (AAID)Android IDDevice ID / IMEISubscriber ID (IMSI)SIM serialHardware MAC address

Where it can go

Third parties present (16)

AppLovinGoogle AdMobInMobiMeta Audience NetworkMintegralPangle (ByteDance)TapjoyUnity AdsVungleironSourceGoogle Analytics for FirebaseGoogle Firebase AnalyticsGoogle Tag ManagerMeta / Facebook SDKAdjustAppsFlyer

Approximate location, Precise location requested while 12 ad/attribution SDK(s) are present (AppLovin, Google AdMob, InMobi +9 more) — location commonly feeds ad targeting.
Persistent-identifier APIs referenced in code (Advertising ID (AAID), Android ID, Device ID / IMEI +3 more) with 16 analytics/ad SDK(s) present — the mechanism used for cross-app profiling.
Camera, Microphone, Photos & files data requested with third-party analytics/ad SDKs present.

This maps what the app can access (permissions it requests, identifier APIs its code references) to the third parties bundled in it. It reflects capability and SDK presence — not proof that a specific value was transmitted.

Data Safety: declared vs observed (Play label vs our analysis)

Declared collected

App info and performance

Declared shared

Device or other IDs

We observe the app can access

Location

⚠ Possible Data Safety mismatch. Label omits 1 category the app can access: Location.

We compare the developer's Google Play Data Safety declaration with what the binary can actually do (permissions it requests, identifier APIs and third-party SDKs it ships). A mismatch is a capability signal to confirm — a requested permission is not proof of collection.

Trackers & SDKs (18 detected · privacy signal, not part of the grade)

Advertising

AppLovinGoogle AdMobInMobiMeta Audience NetworkMintegralPangle (ByteDance)TapjoyUnity AdsVungleironSource

Analytics

Google Analytics for FirebaseGoogle Firebase AnalyticsGoogle Tag ManagerMeta / Facebook SDK

Attribution

AdjustAppsFlyer

Consent

Google UMP (consent)IAB TCF

Build & components

Scanned build 7.47.0. Store metadata may describe a newer release.

APK SHA-2569e00708d6d181de1d6b822e2dcc6a20b1eecb7a60a0ca75df8f8a3aaa95556e4

Signing certificate (who signed this build — factual, not part of the grade)

Signer

CommSource self-signed

Scheme

V3V2

Key

RSA 2048-bit

Algorithm

sha256WithRSA

Validity

2013-06-29 → 3012-10-30

Cert SHA-256

61:48:79:78:f1:ef:2e:c5:fe:b9:a7:ef:73:b4:70:5a:bc:be:14:be:b6:30:e3:96:71:41:37:16:ef:cb:14:eb

The certificate fingerprint identifies the parsed signing certificate. Knowing this public fingerprint does not establish ownership or validate the APK signature.

Signature integrity: not established by certificate parsing.

Component inventory

103 components. Advisory matching covers a curated set; no match is not proof that a component is vulnerability-free.

Search components

Bundled components and recorded advisory matches
Component	Version	Advisory matches
`androidx.activity:activity`	1.8.0	None recorded
`androidx.activity:activity-compose`	1.8.0	None recorded
`androidx.activity:activity-ktx`	1.8.0	None recorded
`androidx.annotation:annotation-experimental`	1.4.1	None recorded
`androidx.appcompat:appcompat`	1.5.1	None recorded
`androidx.appcompat:appcompat-resources`	1.5.1	None recorded
`androidx.asynclayoutinflater:asynclayoutinflater`	1.0.0	None recorded
`androidx.autofill:autofill`	1.0.0	None recorded
`androidx.browser:browser`	1.8.0	None recorded
`androidx.cardview:cardview`	1.0.0	None recorded
`androidx.compose.animation:animation`	1.2.1	None recorded
`androidx.compose.animation:animation-core`	1.2.1	None recorded
`androidx.compose.foundation:foundation`	1.2.1	None recorded
`androidx.compose.foundation:foundation-layout`	1.2.1	None recorded
`androidx.compose.material:material`	1.2.1	None recorded
`androidx.compose.material:material-icons-core`	1.2.1	None recorded
`androidx.compose.material:material-ripple`	1.2.1	None recorded
`androidx.compose.runtime:runtime`	1.7.1	None recorded
`androidx.compose.runtime:runtime-saveable`	1.7.1	None recorded
`androidx.compose.ui:ui`	1.2.1	None recorded
`androidx.compose.ui:ui-geometry`	1.2.1	None recorded
`androidx.compose.ui:ui-graphics`	1.2.1	None recorded
`androidx.compose.ui:ui-text`	1.2.1	None recorded
`androidx.compose.ui:ui-unit`	1.2.1	None recorded
`androidx.compose.ui:ui-util`	1.2.1	None recorded
`androidx.coordinatorlayout:coordinatorlayout`	1.2.0	None recorded
`androidx.core:core`	1.13.0	None recorded
`androidx.core:core-ktx`	1.13.0	None recorded
`androidx.credentials:credentials`	1.2.0-rc01	None recorded
`androidx.credentials:credentials-play-services-auth`	1.2.0-rc01	None recorded
`androidx.cursoradapter:cursoradapter`	1.0.0	None recorded
`androidx.customview:customview`	1.0.0	None recorded
`androidx.customview:customview-poolingcontainer`	1.0.0	None recorded
`androidx.databinding:baseAdapters`	8.12.2	None recorded
`androidx.databinding:databindingKtx`	8.12.2	None recorded
`androidx.databinding:library`	8.12.2	None recorded
`androidx.databinding:viewbinding`	8.12.2	None recorded
`androidx.datastore:datastore`	1.0.0	None recorded
`androidx.documentfile:documentfile`	1.0.0	None recorded
`androidx.drawerlayout:drawerlayout`	1.0.0	None recorded
`androidx.dynamicanimation:dynamicanimation`	1.1.0-alpha03	None recorded
`androidx.dynamicanimation:dynamicanimation-ktx`	1.0.0-alpha03	None recorded
`androidx.emoji2:emoji2`	1.2.0	None recorded
`androidx.emoji2:emoji2-views-helper`	1.2.0	None recorded
`androidx.exifinterface:exifinterface`	1.4.1	None recorded
`androidx.fragment:fragment`	1.5.5	None recorded
`androidx.fragment:fragment-ktx`	1.5.5	None recorded
`androidx.interpolator:interpolator`	1.0.0	None recorded
`androidx.legacy:legacy-support-core-ui`	1.0.0	None recorded
`androidx.legacy:legacy-support-core-utils`	1.0.0	None recorded
`androidx.legacy:legacy-support-v4`	1.0.0	None recorded
`androidx.lifecycle:lifecycle-extensions`	2.2.0	None recorded
`androidx.lifecycle:lifecycle-livedata`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-livedata-core`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-livedata-core-ktx`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-livedata-ktx`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-process`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-runtime`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-runtime-compose`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-runtime-ktx`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-service`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-viewmodel`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-viewmodel-ktx`	2.8.7	None recorded
`androidx.lifecycle:lifecycle-viewmodel-savedstate`	2.8.7	None recorded
`androidx.loader:loader`	1.0.0	None recorded
`androidx.localbroadcastmanager:localbroadcastmanager`	1.0.0	None recorded
`androidx.media:media`	1.6.0	None recorded
`androidx.paging:paging-runtime`	3.2.1	None recorded
`androidx.paging:paging-runtime-ktx`	3.2.1	None recorded
`androidx.palette:palette`	1.0.0	None recorded
`androidx.palette:palette-ktx`	1.0.0	None recorded
`androidx.preference:preference`	1.1.1	None recorded
`androidx.print:print`	1.0.0	None recorded
`androidx.privacysandbox.ads:ads-adservices`	1.0.0-beta05	None recorded
`androidx.privacysandbox.ads:ads-adservices-java`	1.0.0-beta05	None recorded
`androidx.profileinstaller:profileinstaller`	1.3.1	None recorded
`androidx.recyclerview:recyclerview`	1.3.2	None recorded
`androidx.room:room-ktx`	2.7.2	None recorded
`androidx.room:room-runtime`	2.7.2	None recorded
`androidx.savedstate:savedstate`	1.2.1	None recorded
`androidx.savedstate:savedstate-ktx`	1.2.1	None recorded
`androidx.slidingpanelayout:slidingpanelayout`	1.0.0	None recorded
`androidx.sqlite:sqlite`	2.5.1	None recorded
`androidx.sqlite:sqlite-framework`	2.5.1	None recorded
`androidx.startup:startup-runtime`	1.1.1	None recorded
`androidx.swiperefreshlayout:swiperefreshlayout`	1.0.0	None recorded
`androidx.tracing:tracing`	1.0.0	None recorded
`androidx.transition:transition`	1.5.1	None recorded
`androidx.vectordrawable:vectordrawable`	1.1.0	None recorded
`androidx.vectordrawable:vectordrawable-animated`	1.1.0	None recorded
`androidx.versionedparcelable:versionedparcelable`	1.1.1	None recorded
`androidx.viewpager2:viewpager2`	1.1.0-beta02	None recorded
`androidx.viewpager:viewpager`	1.0.0	None recorded
`androidx.webkit:webkit`	1.12.1	None recorded
`androidx.window:window`	1.0.0	None recorded
`androidx.work:work-runtime`	2.8.1	None recorded
`androidx.work:work-runtime-ktx`	2.8.1	None recorded
`com.google.android.material:material`	1.4.0	None recorded
`com.squareup.okhttp3:okhttp`	4.12.0	None recorded
`kotlinx:coroutines_android`	1.10.2	None recorded
`kotlinx:coroutines_core`	1.10.2	None recorded
`kotlinx:coroutines_play_services`	1.10.2	None recorded
`kotlinx:coroutines_slf4j`	1.10.2	None recorded

Export SBOM

About this app · store information

About this app

Snap perfect selfies every time. AI Auto-beautification for that flawless look.

Content ratingTeen

Download size529.9 MB

Privacy policyPublished →

Developer sitewww.beautyplus.com

Screenshots

Scan history

Each row is an observed scan. Gaps between scans do not establish how long a finding existed.

Scanned (UTC)	Build	Score	Grade
2026-10-09 05:01 UTC	7.47.0	92	A
2026-10-02 04:33 UTC	7.46.0	92	A
2026-09-08 01:21 UTC	7.45.0	86	B

View changes between the last two scans →

Export & share

Exports describe the recorded assessment. Signed evidence proves origin and integrity, not completeness or safety.

SARIF Findings CSV Coverage JSON Signed evidence SBOM

Coverage & gap matrix · Verify signed evidence

Embed the latest grade

Embed this grade

The badge reads the latest recorded grade each time it is loaded, and links back to the full report so a reader can see the build it covers and what the scan could not see.

Markdown

[![apk-scanner.com exposure grade](https://apk-scanner.com/app/com.commsource.beautyplus/badge.svg)](https://apk-scanner.com/app/com.commsource.beautyplus)

HTML

<a href="https://apk-scanner.com/app/com.commsource.beautyplus"><img src="https://apk-scanner.com/app/com.commsource.beautyplus/badge.svg" alt="apk-scanner.com exposure grade" height="20"></a>

Grades can move when a new version is scanned or when a detector is corrected. If you would rather publish a grade that cannot change under you, link a signed Proof Capsule instead.

API users can request authenticated, scan-specific exports at /v1/scans/183d1e73-c54d-48b9-b0b3-9a3704ed7c49/findings.sarif (also coverage.json and proof.json).

Request a correction or removal · How to interpret a scan · Browse apps