{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-87-basic_auth_header", "name": "BasicAuthHeader", "shortDescription": { "text": "Hard-coded HTTP Basic credentials" }, "fullDescription": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "helpUri": "https://apk-scanner.com/finding/basic_auth_header", "help": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "8.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-2-firebase_rtdb", "name": "FirebaseRtdb", "shortDescription": { "text": "Firebase Realtime Database reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_rtdb", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-3-gcs_bucket", "name": "GcsBucket", "shortDescription": { "text": "Google Cloud Storage reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/gcs_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-35-exported_provider", "name": "ExportedProvider", "shortDescription": { "text": "Exported ContentProvider without permission" }, "fullDescription": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "helpUri": "https://apk-scanner.com/finding/exported_provider", "help": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-926", "CWE-284", "MASVS-PLATFORM-1" ], "security-severity": "2.0", "cwe": [ "CWE-926", "CWE-284" ], "masvs": [ "MASVS-PLATFORM-1" ] } }, { "id": "APKSCAN-34-cleartext_traffic", "name": "CleartextTraffic", "shortDescription": { "text": "Cleartext (HTTP) traffic permitted" }, "fullDescription": { "text": "Set android:usesCleartextTraffic=false and/or a networkSecurityConfig that forbids cleartext; serve all endpoints over HTTPS." }, "helpUri": "https://apk-scanner.com/finding/cleartext_traffic", "help": { "text": "Set android:usesCleartextTraffic=false and/or a networkSecurityConfig that forbids cleartext; serve all endpoints over HTTPS." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "CWE-319", "MASVS-NETWORK-1" ], "security-severity": "5.0", "cwe": [ "CWE-319" ], "masvs": [ "MASVS-NETWORK-1" ] } }, { "id": "APKSCAN-62-sbom_cve", "name": "SbomCve", "shortDescription": { "text": "Bundled component with a known CVE" }, "fullDescription": { "text": "Confirm the bundled version, then upgrade the dependency to a patched release; track third-party components in an SBOM." }, "helpUri": "https://apk-scanner.com/finding/sbom_cve", "help": { "text": "Confirm the bundled version, then upgrade the dependency to a patched release; track third-party components in an SBOM." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "CWE-937", "CWE-1104", "MASVS-CODE-3" ], "security-severity": "5.0", "cwe": [ "CWE-937", "CWE-1104" ], "masvs": [ "MASVS-CODE-3" ] } } ] } }, "automationDetails": { "id": "apk-scanner/com.netease.yysls/a6b3ca5a-9300-4d34-879a-100cbbf28b54" }, "invocations": [ { "executionSuccessful": false } ], "results": [ { "ruleId": "APKSCAN-87-basic_auth_header", "level": "error", "message": { "text": "Hardcoded HTTP Basic-auth credentials" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_yysls_it2/assets/TotalPackage/Other/tpl_account/qiansi-lin.tpl" } } } ], "partialFingerprints": { "apkscanFingerprint": "488519200980cc21f4d4df45347845714987efc2c65a7636a01b48731eab183e" }, "properties": { "severity": "high", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-2-firebase_rtdb", "level": "note", "message": { "text": "Firebase Realtime Database reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "3a8892188ed94a0608b7ec85cc90bab9bcc09f303cf37513e5401419497eaa22" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657857.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "1577dcd813b93fed793204ad5be6b0fd8659bfdb44d91a4bf7c157158e1f17ef" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657857.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "8095545c1a0ab03b557e159980fb5368a47e4fdeb72ff81c1a9037221b557c55" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657857.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "f3ed7f0fb98cd56e70277af01db7f3c2243e94f543d5b386c53e4423aa77e851" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657857.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "9ea3f6f6ff77c66f997167f9001e84b3da9d0ec9fb525f687135539bf82f5d35" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702173.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "ff1da610b2f8648c24b5f44e65151da0caf2fdf1d279b0e7db683f7b7418b1a4" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702173.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "4901958f49cf27bf750412c18f80779602ce81863f0cd5f1fca50436189e30ae" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702173.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "3e209a6cb501a0c842d9c2dbdaf2405a3a85ba944e9d7f65cb0ed70aadd8b58b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702173.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "56f22342cf8322b90fa3f5219b55c53100680909c7c0774a208da87683aee042" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702173.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "060b24891a8525b7262ebf63085dec8a1affa07f9c20a0c2127729b56f5c1662" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657877.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "9451b92d192d6262d3cb436352108ff2ec5c437483f90af9a8a5c8abbadf852b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657877.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "aa0bee80bd76e3149f3b86b2533688312459f233982a34e800ef68a4e244d022" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657877.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "a6b1319b47e359a80f17c4d1259f445edd99bbcfd0231661a84dae6e6e840933" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657877.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "a78e10a30d5dcbac5e134c83f036a7bdeba4666b9871da2ed0041ae80e95c38f" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657877.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "f4d94d8e91b9c6387fcbb2546335e85b13ff96c076c8b3ab569595599388e5d2" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702156.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "275d1c9c15f0bf1cccc94bf1948e721295ae546edf457073d00e3ed9ae04e7d6" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702156.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "1cc5bab8004d412a2ae749759d5c5ee741d8d5bd50e187a5182035bdc011a1ba" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702156.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "d7e4e4de9b2eef0e176618a1228d3bd83e963ba50f335d9980841f30735ed667" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702156.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "77b652f89b5d40473a3c055427c20cf78e7804a6336063115088e482d395155e" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702156.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "5643d7ea8ae520df954bbf74c02d56a4e741e3da0380ebfa2001e8737c1abac5" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702166.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "bf7e156d111cfdf8981e08a43dc13ead418ad35bb1960fd58b90e50e9c25f9a0" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702166.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "2084782d38aa12827ef2d351a03a1f86fe3ace192b708d2f0b3b7812d4e91bce" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702166.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "f6318e2108f29a22ad1d1b84c127e9325753616ac4509f4a88f5addab34efca3" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702166.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "028072c370fee7f8d56d771ab2aafc118630ff224c79912ae14023bf89f92ef2" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568702166.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "e724c0ad30ed72c6ae6d871b8d04d384e747bb5edcc1fca1d97a2a680ed44bbc" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-3-gcs_bucket", "level": "note", "message": { "text": "Google Cloud Storage reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/4568657857.json" } } } ], "partialFingerprints": { "apkscanFingerprint": "89d6a744f149ebab4eb972e8ed98de8aecd9c23906af8c9e192c31841942f028" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "837ce67c0e3c5fc7fd678c5f252f06887c11043d2431e5e63bc269df02143b8c" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "note", "message": { "text": "Exported content provider without permission (third-party library artifact, shared across 401 unrelated developers)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:com.facebook.FacebookContentProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "b369abc903581edba05e9ec1a5fc46d6b3e7ae316db05c5f7a90becac10e388b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-34-cleartext_traffic", "level": "warning", "message": { "text": "Cleartext (HTTP) traffic permitted" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml" } } } ], "partialFingerprints": { "apkscanFingerprint": "94025ca91177232efea2d52d976e37f967866402c6e01f481a8de610b8e478e7" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "warning", "message": { "text": "Exported content provider without permission" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:.gux.widget.provider.view.support.UxFileProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "21ceae884252fb8739bee442f2e65d624e4b52bad1626b83060f24037bcef2ce" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-62-sbom_cve", "level": "warning", "message": { "text": "com.squareup.okhttp3:okhttp 3.10.0 — CVE-2021-0341" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom:com.squareup.okhttp3:okhttp:CVE-2021-0341" } } } ], "partialFingerprints": { "apkscanFingerprint": "b35496237e28b68c8e0d69cddebe93abcbdeb329cec963569542cc48edb144a4" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-signal" } } ], "properties": { "analysis": { "issues": [ "split_extraction_failed" ], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "partial", "grading": { "policy": "static-coverage-v1", "blockers": [ "analysis_incomplete", "split_extraction_failed" ], "eligible": false }, "timings_ms": { "total": 92354.264, "harvest": 50742.22000000015, "detectors": 36609.2470000002 }, "bytes_total": 877108477, "bytes_scanned": 877108477, "bytes_skipped": 0, "files_processed": 4060, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "c78c327bdfd091a729caccd010e7975986286fb17680cdae826fa202c1e2aae2" }, { "name": "config.arm64_v8a.apk", "sha256": "b413aa4aefe369c026a4a5efbadd5f0166889738616091c807b32a6a45309055" }, { "name": "config.en.apk", "sha256": "2708e76cd3fc4666df34fe32a3d5659d48aa57e987da397a0da6ee6f5b3b0211" }, { "name": "config.xxhdpi.apk", "sha256": "c9b00f4dc3585975b9578fc98b3f130e078ec610b0ff666fb6f0e478cbe28b4e" }, { "name": "yysls_it1.apk", "sha256": "34daa4e929c8bb8de91d3d64f54e7da26e11e5aa93e95fa0400fb6cfdc742044" }, { "name": "yysls_it2.apk", "sha256": "8581f4400e2a8c12f8b686be2a906d8de0e99c6d08834f5ebf084b50c2102953" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "c78c327bdfd091a729caccd010e7975986286fb17680cdae826fa202c1e2aae2", "app_id": "com.netease.yysls", "app_title": "Where Winds Meet", "app_version": "3.9", "scan_id": "a6b3ca5a-9300-4d34-879a-100cbbf28b54", "scanned_at": "2026-10-09T18:32:33.466Z" } } ] }