apk-scanner.com

War Commander: Rogue Assault

com.kixeye.wcm · Build 11.9.0

Analysis: complete. Static analysis completed for this build. A grade is not a guarantee of safety. Historical verification does not establish current reachability.

Grade / score: F · 0/100
Finding categories: 9
Occurrences: 11
Scanned: 2026-10-10T03:26:34.221Z
Document issued: 2026-10-13T21:28:55.138Z
Historical verifications: 2

Finding evidence

Open a category to review its occurrences. Printing includes all categories and occurrences.

Amazon S3 bucket reference — confirmed publicly readable · critical · 2 occurrences

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

https://███████████.s3.us-west-2.amazonaws.com/███ · Historical verification at scan time
https://███████████.s3.us-west-2.amazonaws.com/███ · Historical verification at scan time

Application data is backup-enabled · info · 1 occurrence

Backup is on by default on Android; this manifest states it explicitly. If the app stores sensitive local data, define dataExtractionRules/fullBackupContent to exclude it, or set android:allowBackup=false.

CWE-530 · CWE-312 · MASVS-STORAGE-1 · MASVS-STORAGE-2

android:allowBackup="true"

Firebase Realtime Database reference · low · 1 occurrence

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

https://████████████████████████.firebaseio.com/███

Google Cloud Storage reference · low · 2 occurrences

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

https://███████.googleapis.com/███
https://███████.googleapis.com/███

Google API key (client-shipped; restriction unverified) · low · 1 occurrence

Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control.

CWE-798 · MASVS-STORAGE-1

AIza•••••••• (21–40 chars, redacted)

Exported content provider without permission (third-party library artifact, shared across 402 unrelated developers) · low · 1 occurrence

Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly.

CWE-926 · CWE-284 · MASVS-PLATFORM-1

FacebookContentProvider (exported, no permission)

Firebase Storage bucket reference · low · 1 occurrence

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

████████████

Cleartext (HTTP) traffic permitted · medium · 1 occurrence

Set android:usesCleartextTraffic=false and/or a networkSecurityConfig that forbids cleartext; serve all endpoints over HTTPS.

CWE-319 · MASVS-NETWORK-1

android:usesCleartextTraffic="true"

Short signing key (RSA 1024-bit) · medium · 1 occurrence

Use an RSA key of at least 2048 bits or an EC P-256 key for signing.

CWE-326 · MASVS-CRYPTO-1

RSA-1024

Control coverage

Mapped static evidence does not establish a control pass. Manual assessment remains separate.

Control	Requirement	Recorded status
MASVS-STORAGE-1	The app securely stores sensitive data.	Review signal
MASVS-STORAGE-2	The app prevents leakage of sensitive data.	Historical verification
MASVS-CRYPTO-1	The app employs current strong cryptography and uses it according to best practices.	Review signal
MASVS-CRYPTO-2	The app performs key management according to best practices.	No static findings · not a pass
MASVS-AUTH-1	The app uses secure authentication and authorization protocols.	Manual assessment
MASVS-AUTH-2	The app performs local authentication securely.	Manual assessment
MASVS-AUTH-3	The app secures sensitive operations with additional authentication.	Manual assessment
MASVS-NETWORK-1	The app secures all network traffic according to current best practices.	Review signal
MASVS-NETWORK-2	The app verifies the identity of the remote endpoint (e.g. certificate pinning).	No static findings · not a pass
MASVS-PLATFORM-1	The app uses IPC mechanisms securely.	Review signal
MASVS-PLATFORM-2	The app uses WebViews securely.	No static findings · not a pass
MASVS-PLATFORM-3	The app uses the user interface securely.	Manual assessment
MASVS-CODE-1	The app requires an up-to-date platform version.	No static findings · not a pass
MASVS-CODE-2	The app has a mechanism for enforcing updates.	Manual assessment
MASVS-CODE-3	The app only uses software components without known vulnerabilities.	No static findings · not a pass
MASVS-CODE-4	The app validates and sanitizes all untrusted inputs and follows secure-coding practice.	No static findings · not a pass
MASVS-RESILIENCE-1	The app validates the integrity of the platform.	Manual assessment
MASVS-RESILIENCE-2	The app implements anti-tampering mechanisms.	Manual assessment
MASVS-RESILIENCE-3	The app implements anti-static-analysis mechanisms.	Manual assessment
MASVS-RESILIENCE-4	The app implements anti-dynamic-analysis techniques.	Manual assessment
MASVS-PRIVACY-1	The app minimizes access to sensitive data and resources.	No static findings · not a pass
MASVS-PRIVACY-2	The app prevents identification of the user.	No static findings · not a pass
MASVS-PRIVACY-3	The app is transparent about data collection and usage.	No static findings · not a pass
MASVS-PRIVACY-4	The app offers user control over their data.	Manual assessment

Build identity and signature

Scan ID: 5a7c0fbf-4538-4fd1-bf02-b72c47c6f763
APK SHA-256: 8dd4af45d9ef718eaecf20d958ff6d8678ce8f5e10c675e401f9111a2094cd84
Capsule SHA-256: e41ad3ca2cbae35863f237a23c9c94e85be5926fb71a870d69852c1f63a3c6ae
Signing key: IE6LeZNX4dAAPLGr

Verify the signed JSON at apk-scanner.com/verify. This printed view is a presentation of the signed record; the JSON is the verification artifact.