apk-scanner.com

Airtel: Recharge, Bank & Loans

com.myairtelapp · Build 4.153.2

Analysis: complete. Static analysis completed for this build. A grade is not a guarantee of safety. Historical verification does not establish current reachability.

Grade / score: D · 40/100
Finding categories: 7
Occurrences: 87
Scanned: 2026-10-11T03:56:59.426Z
Document issued: 2026-10-13T18:41:53.380Z
Historical verifications: 0

Finding evidence

Open a category to review its occurrences. Printing includes all categories and occurrences.

Hardcoded HTTP Basic-auth credentials · high · 3 occurrences

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

CWE-798 · MASVS-STORAGE-1

Basic ••••••:•••••••• (redacted)
Basic ••••••:•••••••• (redacted)
Basic ••••••:•••••••• (redacted)

Amazon S3 bucket reference · low · 73 occurrences

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
https://█████████████████.s3-ap-southeast-1.amazonaws.com/███
https://█████████████████.s3-ap-southeast-1.amazonaws.com/███
https://█████████████████.s3-ap-southeast-1.amazonaws.com/███
https://█████████████████.s3-ap-southeast-1.amazonaws.com/███
https://█████████████████.s3-ap-southeast-1.amazonaws.com/███
https://█████████████████.s3-ap-southeast-1.amazonaws.com/███
https://█████████████████.s3-ap-southeast-1.amazonaws.com/███
https://█████████████████.s3-ap-southeast-1.amazonaws.com/███
https://█████████████████.amazonaws.com/███
https://████.ap-south-1.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
https://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
https://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
https://███████████████.s3.amazonaws.com/███
https://███████████████.s3.amazonaws.com/███
https://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
https://████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
https://█████████████████.amazonaws.com/███
https://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███
http://█████████████████.amazonaws.com/███

Firebase Realtime Database reference · low · 1 occurrence

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

https://███████████████████████████.firebaseio.com/███

Google API key (client-shipped; restriction unverified) · low · 4 occurrences

Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control.

CWE-798 · MASVS-STORAGE-1

AIza•••••••• (21–40 chars, redacted)
AIza•••••••• (21–40 chars, redacted)
AIza•••••••• (21–40 chars, redacted)
AIza•••••••• (21–40 chars, redacted)

Firebase Storage bucket reference · low · 4 occurrences

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

████████████
████████████
████████████
████████████

Background location access with advertising SDKs present · low · 1 occurrence

Justify background location; request foreground-only where possible and disclose the use in the Play Data Safety form.

CWE-359 · MASVS-PRIVACY-1

background location + ad SDKs

Sentry DSN · low · 1 occurrence

A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events.

CWE-200 · MASVS-STORAGE-2

https://█████████████████.ingest.sentry.io/███

Control coverage

Mapped static evidence does not establish a control pass. Manual assessment remains separate.

Control	Requirement	Recorded status
MASVS-STORAGE-1	The app securely stores sensitive data.	Review signal
MASVS-STORAGE-2	The app prevents leakage of sensitive data.	Review signal
MASVS-CRYPTO-1	The app employs current strong cryptography and uses it according to best practices.	No static findings · not a pass
MASVS-CRYPTO-2	The app performs key management according to best practices.	No static findings · not a pass
MASVS-AUTH-1	The app uses secure authentication and authorization protocols.	Manual assessment
MASVS-AUTH-2	The app performs local authentication securely.	Manual assessment
MASVS-AUTH-3	The app secures sensitive operations with additional authentication.	Manual assessment
MASVS-NETWORK-1	The app secures all network traffic according to current best practices.	No static findings · not a pass
MASVS-NETWORK-2	The app verifies the identity of the remote endpoint (e.g. certificate pinning).	No static findings · not a pass
MASVS-PLATFORM-1	The app uses IPC mechanisms securely.	No static findings · not a pass
MASVS-PLATFORM-2	The app uses WebViews securely.	No static findings · not a pass
MASVS-PLATFORM-3	The app uses the user interface securely.	Manual assessment
MASVS-CODE-1	The app requires an up-to-date platform version.	No static findings · not a pass
MASVS-CODE-2	The app has a mechanism for enforcing updates.	Manual assessment
MASVS-CODE-3	The app only uses software components without known vulnerabilities.	No static findings · not a pass
MASVS-CODE-4	The app validates and sanitizes all untrusted inputs and follows secure-coding practice.	No static findings · not a pass
MASVS-RESILIENCE-1	The app validates the integrity of the platform.	Manual assessment
MASVS-RESILIENCE-2	The app implements anti-tampering mechanisms.	Manual assessment
MASVS-RESILIENCE-3	The app implements anti-static-analysis mechanisms.	Manual assessment
MASVS-RESILIENCE-4	The app implements anti-dynamic-analysis techniques.	Manual assessment
MASVS-PRIVACY-1	The app minimizes access to sensitive data and resources.	Review signal
MASVS-PRIVACY-2	The app prevents identification of the user.	No static findings · not a pass
MASVS-PRIVACY-3	The app is transparent about data collection and usage.	No static findings · not a pass
MASVS-PRIVACY-4	The app offers user control over their data.	Manual assessment

Build identity and signature

Scan ID: d72cbe67-9526-4164-90fd-2bb6f1ac73b2
APK SHA-256: 68b3ff768cefcc0ef36c2393e358f549d08e6202e279fa09a6942f3d251e9274
Capsule SHA-256: 6e9d2642d03d94f962f35b8b8e73812e3ae016d5fb7d9ae562b45d4b0b06937f
Signing key: IE6LeZNX4dAAPLGr

Verify the signed JSON at apk-scanner.com/verify. This printed view is a presentation of the signed record; the JSON is the verification artifact.