{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-2-firebase_rtdb", "name": "FirebaseRtdb", "shortDescription": { "text": "Firebase Realtime Database reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_rtdb", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-27-github_pat", "name": "GithubPat", "shortDescription": { "text": "GitHub personal access token" }, "fullDescription": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "helpUri": "https://apk-scanner.com/finding/github_pat", "help": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-60-bg_location", "name": "BgLocation", "shortDescription": { "text": "Background location access" }, "fullDescription": { "text": "Justify background location; request foreground-only where possible and disclose the use in the Play Data Safety form." }, "helpUri": "https://apk-scanner.com/finding/bg_location", "help": { "text": "Justify background location; request foreground-only where possible and disclose the use in the Play Data Safety form." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-359", "MASVS-PRIVACY-1" ], "security-severity": "2.0", "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-1" ] } }, { "id": "APKSCAN-72-sentry_dsn", "name": "SentryDsn", "shortDescription": { "text": "Sentry DSN" }, "fullDescription": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "helpUri": "https://apk-scanner.com/finding/sentry_dsn", "help": { "text": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-77-ds_underdeclare", "name": "DsUnderdeclare", "shortDescription": { "text": "Data Safety label omits an observed data category" }, "fullDescription": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "helpUri": "https://apk-scanner.com/finding/ds_underdeclare", "help": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-359", "MASVS-PRIVACY-3" ], "security-severity": "2.0", "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-3" ] } } ] } }, "automationDetails": { "id": "apk-scanner/com.current.app/79477a96-675f-4f31-b228-488441d94a42" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-2-firebase_rtdb", "level": "note", "message": { "text": "Firebase Realtime Database reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "d82972c723fad87ad5a70244140629d43d8728ce9d1f50b64d02612d0fc56c2b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "b3017cb07abd52da92fe8438bd1722087e4c87c0f1ed97abb49200364ae6af94" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "485f3e4de98a1c48028da3ada5fabb76cda858629d40619fde45d60dd60a110c" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-27-github_pat", "level": "note", "message": { "text": "GitHub personal access token (third-party library artifact, shared across 19 unrelated developers)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/mlkit_label_default_model/mobile_ica_8bit_with_metadata_tflite" } } } ], "partialFingerprints": { "apkscanFingerprint": "ea0b1ad15a7f18b3e189f591e05a2b42b6e8b59621cf5f24c4cb76f31f242bc9" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "b12dfc980483521346a6e360da17e558b8b73597f0af61518c9dade643d28686" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-60-bg_location", "level": "note", "message": { "text": "Background location access with advertising SDKs present" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "pii:bgloc" } } } ], "partialFingerprints": { "apkscanFingerprint": "0c010d775be9542eee48043eb496c06888f9b8e8fcdf3af66a6b84e99192f6ce" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes4.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "0c6da1e04c0856181b2905adb0c7f08a3506827f3dfedfcad7982a9cddc4e5c0" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-72-sentry_dsn", "level": "note", "message": { "text": "Sentry DSN" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml" } } } ], "partialFingerprints": { "apkscanFingerprint": "8dc12d0a5b7401daf4a6c0de62f88ab3b8ff2756e30723c282d6fec60e4ce02e" }, "properties": { "severity": "low", "verified": false, "relationship": "informational" } }, { "ruleId": "APKSCAN-77-ds_underdeclare", "level": "note", "message": { "text": "Data Safety label omits Contacts" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "data-safety:Contacts" } } } ], "partialFingerprints": { "apkscanFingerprint": "52d6df5eafe80ad7de0275ee425de0bf8d715439e92a9026117bea4d546827d0" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 23628.06, "harvest": 6650.024999999988, "detectors": 14872.211000000003 }, "bytes_total": 125532707, "bytes_scanned": 125532707, "bytes_skipped": 0, "files_processed": 3937, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "b11eac27e1d08c6df9fdcee03359392c6a499cf05e197f42c734cfca9aae6f65" }, { "name": "config.arm64_v8a.apk", "sha256": "f30e081e7308a403f78b4b101d900dc6ac16cd17c6a7bbc1e93d1d838bad1a7c" }, { "name": "config.en.apk", "sha256": "0781f9d94f46e34191e9cde71e3be898a1fe15c740e32f9bdfe6e5e631013a55" }, { "name": "config.xxhdpi.apk", "sha256": "c6ec0d2647d7b829244b4e2a29305ea35a0de66de63987f6ffabe43327ffa850" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "b11eac27e1d08c6df9fdcee03359392c6a499cf05e197f42c734cfca9aae6f65", "app_id": "com.current.app", "app_title": "Current - Mobile Banking", "app_version": "8.19.1", "scan_id": "79477a96-675f-4f31-b228-488441d94a42", "scanned_at": "2026-10-10T14:01:56.722Z" } } ] }