{
  "ok": true,
  "app_id": "com.joistapp.android.joist",
  "comparable": false,
  "comparison_status": "limited_coverage",
  "regressed": true,
  "grade_delta": null,
  "score_delta": null,
  "from": {
    "scan_id": "5da1f0d6-9f09-4219-95f1-36cbee4679a2",
    "version": "3.82.1",
    "analysis": {
      "status": "unknown"
    },
    "provenance": {},
    "grade": "D",
    "score": 40,
    "scanned_at": "2026-09-03T08:57:05.411Z"
  },
  "to": {
    "scan_id": "2f91d2c8-f339-4815-98b6-4b345d493ccd",
    "version": "3.86.0",
    "analysis": {
      "issues": [],
      "stages": {
        "pii": "complete",
        "sbom": "complete",
        "signing": "certificate_parsed",
        "strings": "complete",
        "manifest": "complete"
      },
      "status": "complete",
      "grading": {
        "policy": "static-coverage-v1",
        "blockers": [],
        "eligible": true
      },
      "timings_ms": {
        "total": 54658.927,
        "harvest": 11049.96799999999,
        "detectors": 41115.15099999964
      },
      "bytes_total": 237439170,
      "bytes_scanned": 237439170,
      "bytes_skipped": 0,
      "files_processed": 5933,
      "coverage_version": 2,
      "string_encodings": [
        "ascii",
        "utf16le"
      ],
      "signature_validation": "not_performed"
    },
    "provenance": {
      "mode": "static",
      "artifacts": [
        {
          "name": "base.apk",
          "sha256": "9438fea80dc7981784fe06c7fc148f2178e53070025b6c4050a960b4743f2e25"
        },
        {
          "name": "config.arm64_v8a.apk",
          "sha256": "95bffb4f1fe15a157c697610f30e70993005f38bc3fcb912a9c3fd3a3431f487"
        },
        {
          "name": "config.xxhdpi.apk",
          "sha256": "4a9459e159c0243a7f520ef39745c65b62cecd54896971645835067a55efc7ba"
        }
      ],
      "ruleset_sha256": "69544396ce47de08b97fb3d04080662e1cbb38c704bd5aa3d4b7e5489cde22e8"
    },
    "grade": "B",
    "score": 76,
    "scanned_at": "2026-09-29T09:43:24.811Z"
  },
  "findings": {
    "added": [
      {
        "finding_type": 1,
        "severity": "low",
        "title": "Amazon S3 bucket reference",
        "fingerprint": "6d3265bf2f5e1221c48d93b1c227e7ca5f10732ade5bc66fdfaf8eac1681c80b",
        "verified": false
      },
      {
        "finding_type": 20,
        "severity": "low",
        "title": "Google API key (client-shipped; restriction unverified)",
        "fingerprint": "f47be55629ea004aebd62963a70f117452cc7954f4162268735f25ed67941b5e",
        "verified": false
      },
      {
        "finding_type": 20,
        "severity": "low",
        "title": "Google API key (client-shipped; restriction unverified)",
        "fingerprint": "602876b569edee51be4079ab5da5bca85593d9e84435cdac1298babdb2269360",
        "verified": false
      },
      {
        "finding_type": 2,
        "severity": "low",
        "title": "Firebase Realtime Database reference",
        "fingerprint": "bfde9031f5f8a99a08c822e2d0d0d53990b8ed16c8d5fbf3af4efe8d1f53eacb",
        "verified": false
      },
      {
        "finding_type": 53,
        "severity": "low",
        "title": "Firebase Storage bucket reference",
        "fingerprint": "5cef1ead059ae7bd019889bd92a902d1be53156ccfb111c4c2133515e4a0ddd7",
        "verified": false
      },
      {
        "finding_type": 87,
        "severity": "high",
        "title": "Hardcoded HTTP Basic-auth credentials",
        "fingerprint": "63d4dae6ff31159a775813f0624c540df6fe7bef0e7c917a77b1f3a20d536ebc",
        "verified": false
      },
      {
        "finding_type": 70,
        "severity": "low",
        "title": "BIP39 wallet seed phrase (12 words, checksum valid) (third-party library artifact, shared across 12 unrelated developers)",
        "fingerprint": "5348899ede7abc0aeacd200b1aa38955ddb5410803f05b314e4faeab99fb7496",
        "verified": false
      },
      {
        "finding_type": 20,
        "severity": "low",
        "title": "Google API key (client-shipped; restriction unverified)",
        "fingerprint": "0dd7733861247168e71db297ed3192c379054d6c003554989c2cb089e6e18d49",
        "verified": false
      },
      {
        "finding_type": 77,
        "severity": "low",
        "title": "Data Safety label omits Contacts",
        "fingerprint": "52d6df5eafe80ad7de0275ee425de0bf8d715439e92a9026117bea4d546827d0",
        "verified": false
      },
      {
        "finding_type": 77,
        "severity": "low",
        "title": "Data Safety label omits Location",
        "fingerprint": "cacfd47daa7d0aafb7cbd1791f3964ef2850687203797b5e24429c41acdf7290",
        "verified": false
      }
    ],
    "removed": [
      {
        "finding_type": 20,
        "severity": "low",
        "title": "Google API key (client-shipped; restriction unverified)",
        "fingerprint": "bbf52c12028650ae3a71ede3bbe5cfc26f5143215a2b78fa86f268746d0af137",
        "verified": false
      },
      {
        "finding_type": 1,
        "severity": "low",
        "title": "Amazon S3 bucket reference",
        "fingerprint": "235a4e576184b9c8a365616036ea6d059582916088a598a3ac690577d0ba174d",
        "verified": false
      },
      {
        "finding_type": 20,
        "severity": "low",
        "title": "Google API key (client-shipped; restriction unverified)",
        "fingerprint": "8dfafca680f449b94a571d87c6fc28b5121f296bb0e27d34c5bd35aee7a48d8c",
        "verified": false
      },
      {
        "finding_type": 2,
        "severity": "low",
        "title": "Firebase Realtime Database reference",
        "fingerprint": "0612cf3617208a7cf613c52f271f402bf270a2560e4c8bca58866d4edb077ea9",
        "verified": false
      },
      {
        "finding_type": 53,
        "severity": "low",
        "title": "Firebase Storage bucket reference",
        "fingerprint": "529689451124d3f42eece800bbbc6085e86ab7da6de9c4dc540e0b4cf02a3772",
        "verified": false
      },
      {
        "finding_type": 70,
        "severity": "critical",
        "title": "BIP39 wallet seed phrase (12 words, checksum valid)",
        "fingerprint": "4b201cf864bd066e09a87a79bac2dbce70979e6b87b35d52d5fc60a65f8421e6",
        "verified": false
      },
      {
        "finding_type": 20,
        "severity": "low",
        "title": "Google API key (client-shipped; restriction unverified)",
        "fingerprint": "dc08bd319ae35045917a696b2c7c721b7e0e6036b02b06dcce5461dd50752cfa",
        "verified": false
      },
      {
        "finding_type": 77,
        "severity": "low",
        "title": "Data Safety label omits Contacts",
        "fingerprint": "38151aa20c8ccd2e1d72f12d1735b09ff5ac035bcec20c1114af2739bcabc70f",
        "verified": false
      },
      {
        "finding_type": 77,
        "severity": "low",
        "title": "Data Safety label omits Location",
        "fingerprint": "746018325d4655ce37eb438edab4ebdb0328c1767d4d0e3865a0c7a344f89921",
        "verified": false
      }
    ],
    "persisting_count": 0,
    "added_by_sev": {
      "critical": 0,
      "high": 1,
      "medium": 0,
      "low": 9
    },
    "removed_by_sev": {
      "critical": 1,
      "high": 0,
      "medium": 0,
      "low": 8
    }
  },
  "trackers": {
    "added": [
      "Google Analytics for Firebase",
      "IAB TCF"
    ],
    "removed": [
      "Google AdServices"
    ]
  },
  "known_vulns": {
    "from": 0,
    "to": 0,
    "delta": 0,
    "from_recorded": true,
    "to_recorded": true
  }
}