{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-1-s3_bucket", "name": "S3Bucket", "shortDescription": { "text": "Amazon S3 bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/s3_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-2-firebase_rtdb", "name": "FirebaseRtdb", "shortDescription": { "text": "Firebase Realtime Database reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_rtdb", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-3-gcs_bucket", "name": "GcsBucket", "shortDescription": { "text": "Google Cloud Storage reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/gcs_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-77-ds_underdeclare", "name": "DsUnderdeclare", "shortDescription": { "text": "Data Safety label omits an observed data category" }, "fullDescription": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "helpUri": "https://apk-scanner.com/finding/ds_underdeclare", "help": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-359", "MASVS-PRIVACY-3" ], "security-severity": "2.0", "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-3" ] } }, { "id": "APKSCAN-79-basic_auth_url", "name": "BasicAuthUrl", "shortDescription": { "text": "Hard-coded credentials in a URL" }, "fullDescription": { "text": "Remove the embedded username:password, rotate the credential, and authenticate to the endpoint with short-lived per-user tokens instead." }, "helpUri": "https://apk-scanner.com/finding/basic_auth_url", "help": { "text": "Remove the embedded username:password, rotate the credential, and authenticate to the endpoint with short-lived per-user tokens instead." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1", "MASVS-AUTH-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1", "MASVS-AUTH-1" ] } } ] } }, "automationDetails": { "id": "apk-scanner/com.fortnofffinancial.dealcheck_rentals/52404bfb-d9a6-4a07-8ad2-bc52c6898444" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/lib/ionic/js/ionic-angular.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "c5dd8a3d73fce730bacf72de5bc3863d77d7f2abc5d84e443a6133a06e8f54de" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/lib/ionic/js/ionic-angular.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "301a80ae7b1d9befb86ce139e8c2070dab2f3eb49434451a2139f3c50a6af618" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/lib/ionic/js/ionic-angular.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "597b5c7aa5b69e9e43cc74bf88e23d61fb55bf8e21155dd8b5c5b0709e28682f" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-2-firebase_rtdb", "level": "note", "message": { "text": "Firebase Realtime Database reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/js/constants.dev.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "435ee1844f50e96e835fcdcf6f75bb02f7add0228621d274bf9b908baf680b23" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-2-firebase_rtdb", "level": "note", "message": { "text": "Firebase Realtime Database reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/external/js/constants.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "8d1a09f942d73760d6bd40e2171674e36aec2a4e9ec3bbfa7a4240541afb548e" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/lib/ngmap/directives/map-data.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "52ae1f7a670f2c7c208cd9c09cb94d7acc4ec2e79071825db71595fce4f3075d" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/js/constants.dev.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "8a8ee392d69aee1e505aba8ecf7a12ea12d64f575a4f0b2720fcea2d5ade2b00" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/lib/ngmap/testapp/script-tags-for-development.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "10a894f26afef81cf1aa668d4c15c8e36db231ee4f2e226c2a8af4394b9d17a0" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/js/constants.dev.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "fe34bc5d60d6b7810606eed17a44179d0071e347edb577382bb5334a6ded7a9d" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/external/js/constants.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "c6f4285c35c8edb91de126e4d350e77ab4c70065c1001986f46409b3ddbd74e0" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/index.html" } } } ], "partialFingerprints": { "apkscanFingerprint": "3b7f1551125311d198661335dfcbc18816810fb58d13f93e493b257a7d2a8b6a" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/lib/angular/angular.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "f89adfc5b2494ed1fcef067c465b6f85b89a0bf4b2c08f4e7b124ea64ae5083f" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/external/js/constants.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "8c15b740f28236b2b5dce84f944d650ae68ad60477854a53bf34ebfef432ac10" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/js/constants.dev.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "dfa881f54405a8255debe47d316f543737d861dd4907793538755a70c880a10a" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/lib/ngmap/testapp/map-projection-simple.html" } } } ], "partialFingerprints": { "apkscanFingerprint": "b30e1258f1726c11905af5a30c5535c8d3fc4e847fb627986477a6193331c5c9" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-77-ds_underdeclare", "level": "note", "message": { "text": "Data Safety label omits Location" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "data-safety:Location" } } } ], "partialFingerprints": { "apkscanFingerprint": "cacfd47daa7d0aafb7cbd1791f3964ef2850687203797b5e24429c41acdf7290" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-79-basic_auth_url", "level": "note", "message": { "text": "Hardcoded credentials in a URL (third-party library artifact, shared across 6 unrelated developers)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/www/lib/angular/angular.js" } } } ], "partialFingerprints": { "apkscanFingerprint": "342cdede3c04d1dd83f4eac7b0ba4c9d6f9f7e5cedeacaecb73d0533c3f15578" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 56979.757, "harvest": 5065.021999999995, "detectors": 50223.29099999999 }, "bytes_total": 112718532, "bytes_scanned": 112718532, "bytes_skipped": 0, "files_processed": 2574, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "eb7eced4d0384aef379feae54eaff1572d0942c814866361456377901dfd3094" }, { "name": "config.arm64_v8a.apk", "sha256": "85b65b1387c7abece87ea5a4bf40881593801a5b2eb480d34ab8184bd09fa703" }, { "name": "config.en.apk", "sha256": "2b37f7fce32d82b964c1e2249151b3f32b73db280dbdc30b5dc9949fc33b8786" }, { "name": "config.xxhdpi.apk", "sha256": "6a8acf5ea5b4734214e18b4ca5fe0c659c6bbee5312d716b8f235406baaf2e0d" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "eb7eced4d0384aef379feae54eaff1572d0942c814866361456377901dfd3094", "app_id": "com.fortnofffinancial.dealcheck_rentals", "app_title": "DealCheck: Analyze Real Estate", "app_version": "4.41.1", "scan_id": "52404bfb-d9a6-4a07-8ad2-bc52c6898444", "scanned_at": "2026-10-08T01:00:43.771Z" } } ] }