Coverage & review gaps
com.joyolabs.noteifyBuild 2.6.2 · 2026-10-13 04:02 UTC
A · 92/100Static analysis completeMapped to OWASP MASVS v2. No static findings is not a pass.
Control evidence
Gap signalMASVS-STORAGE-1The app securely stores sensitive data.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
- Application data is backup-enabled View category
- Google API key (client-shipped; restriction unverified) View category
Gap signalMASVS-STORAGE-2The app prevents leakage of sensitive data.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
- Application data is backup-enabled View category
- Firebase Storage bucket reference View category
- Firebase Storage bucket reference View category
- Firebase Storage bucket reference View category
No static findingsMASVS-CRYPTO-1The app employs current strong cryptography and uses it according to best practices.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
No static findingsMASVS-CRYPTO-2The app performs key management according to best practices.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
Manual reviewMASVS-AUTH-1The app uses secure authentication and authorization protocols.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
Manual reviewMASVS-AUTH-2The app performs local authentication securely.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
Manual reviewMASVS-AUTH-3The app secures sensitive operations with additional authentication.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
Gap signalMASVS-NETWORK-1The app secures all network traffic according to current best practices.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
- Cleartext (HTTP) traffic permitted View category
No static findingsMASVS-NETWORK-2The app verifies the identity of the remote endpoint (e.g. certificate pinning).
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
No static findingsMASVS-PLATFORM-1The app uses IPC mechanisms securely.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
No static findingsMASVS-PLATFORM-2The app uses WebViews securely.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
Manual reviewMASVS-PLATFORM-3The app uses the user interface securely.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
No static findingsMASVS-CODE-1The app requires an up-to-date platform version.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
Manual reviewMASVS-CODE-2The app has a mechanism for enforcing updates.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
No static findingsMASVS-CODE-3The app only uses software components without known vulnerabilities.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
No static findingsMASVS-CODE-4The app validates and sanitizes all untrusted inputs and follows secure-coding practice.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
Manual reviewMASVS-RESILIENCE-1The app validates the integrity of the platform.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
Manual reviewMASVS-RESILIENCE-2The app implements anti-tampering mechanisms.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
Manual reviewMASVS-RESILIENCE-3The app implements anti-static-analysis mechanisms.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
Manual reviewMASVS-RESILIENCE-4The app implements anti-dynamic-analysis techniques.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
No static findingsMASVS-PRIVACY-1The app minimizes access to sensitive data and resources.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
No static findingsMASVS-PRIVACY-2The app prevents identification of the user.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
No static findingsMASVS-PRIVACY-3The app is transparent about data collection and usage.
Static findings provide evidence toward a review; they do not establish a pass or compliance.
No mapped static findings recorded.
Manual reviewMASVS-PRIVACY-4The app offers user control over their data.
This control requires manual or dynamic assessment.
No mapped static findings recorded.
No matching records. Change or clear your filters.
Exports & assessment notes
Static, metadata-only analysis. Each control is scored evidence-for / gap-signal / requires-manual-testing. This is evidence toward a MASVS assessment, NOT a certification — apk-scanner.com is not an authorized assessment lab. Absence of a static finding does not prove a control passes.