apk-scanner.com

Chomp SMS

com.p1.chompsms · Build 9.30

Analysis: complete. Static analysis completed for this build. A grade is not a guarantee of safety. Historical verification does not establish current reachability.

Grade / score
B · 80/100
Finding categories
5
Occurrences
52
Scanned
2026-10-09T01:53:31.115Z
Document issued
2026-10-14T02:27:58.861Z
Historical verifications
5

Finding evidence

Open a category to review its occurrences. Printing includes all categories and occurrences.

Amazon S3 bucket reference · low · 40 occurrences

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

  • https://████████████████████████.s3.amazonaws.com/███
  • https://███████████████████.s3.amazonaws.com/███
  • https://████████████.s3.eu-central-1.amazonaws.com/███
  • https://███████████.s3.eu-west-1.amazonaws.com/███
  • https://██████████████████████.s3.us-west-2.amazonaws.com/███
  • https://█████████████.s3.amazonaws.com/███ · Historical verification at scan time
  • https://███████████.s3.eu-west-1.amazonaws.com/███
  • https://███████████████████.s3-eu-west-1.amazonaws.com/███
  • https://███████.s3.eu-west-1.amazonaws.com/███
  • https://███████████████.s3.eu-west-1.amazonaws.com/███
  • https://█████████████████████████████.s3.eu-central-1.amazonaws.com/███
  • https://████.s3.eu-west-1.amazonaws.com/███
  • https://███████████████████.s3.amazonaws.com/███
  • https://█████████████████.s3.eu-west-1.amazonaws.com/███
  • https://███████.s3.eu-central-1.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://███████████████████████████.s3.eu-west-1.amazonaws.com/███
  • https://██████████████████.s3.amazonaws.com/███
  • https://█████████.s3.eu-central-1.amazonaws.com/███ · Historical verification at scan time
  • https://███████████████████.s3.eu-west-1.amazonaws.com/███
  • https://██████████████████.s3.eu-central-1.amazonaws.com/███
  • https://██████████████.s3.amazonaws.com/███
  • https://██████████.s3.amazonaws.com/███
  • https://█████████.s3.eu-central-1.amazonaws.com/███ · Historical verification at scan time
  • https://█████████.s3.amazonaws.com/███
  • https://█████████████.s3.eu-central-1.amazonaws.com/███
  • https://████████████.s3.amazonaws.com/███
  • https://█████████████████████████.s3.eu-central-1.amazonaws.com/███
  • https://█████████.s3.eu-central-1.amazonaws.com/███
  • https://████████████████████.s3.eu-west-2.amazonaws.com/███
  • https://████.eu-west-1.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.eu-west-1.amazonaws.com/███
  • https://████.eu-west-1.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████████████.amazonaws.com/███
  • https://████.eu-west-1.amazonaws.com/███
  • https://████.eu-west-1.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
Google Cloud Storage reference · low · 9 occurrences

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

  • https://███████.googleapis.com/███
  • https://███████.googleapis.com/███
  • https://███████.googleapis.com/███
  • https://███████████████.storage.googleapis.com/███
  • https://███████.googleapis.com/███
  • https://███████.googleapis.com/███
  • https://███████.googleapis.com/███ · Historical verification at scan time
  • https://███████.googleapis.com/███ · Historical verification at scan time
  • https://███████████████████████████.storage.googleapis.com/███
Exported content provider without permission · medium · 1 occurrence

Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly.

CWE-926 · CWE-284 · MASVS-PLATFORM-1

  • ThemeProvider (exported, no permission)
Short signing key (RSA 1024-bit) · medium · 1 occurrence

Use an RSA key of at least 2048 bits or an EC P-256 key for signing.

CWE-326 · MASVS-CRYPTO-1

  • RSA-1024
com.squareup.okhttp3:okhttp 3.12.13 — CVE-2021-0341 · medium · 1 occurrence

Confirm the bundled version, then upgrade the dependency to a patched release; track third-party components in an SBOM.

CWE-937 · CWE-1104 · MASVS-CODE-3

  • CVE-2021-0341 (fixed in 4.9.2)

Control coverage

Mapped static evidence does not establish a control pass. Manual assessment remains separate.

ControlRequirementRecorded status
MASVS-STORAGE-1The app securely stores sensitive data.No static findings · not a pass
MASVS-STORAGE-2The app prevents leakage of sensitive data.Historical verification
MASVS-CRYPTO-1The app employs current strong cryptography and uses it according to best practices.Review signal
MASVS-CRYPTO-2The app performs key management according to best practices.No static findings · not a pass
MASVS-AUTH-1The app uses secure authentication and authorization protocols.Manual assessment
MASVS-AUTH-2The app performs local authentication securely.Manual assessment
MASVS-AUTH-3The app secures sensitive operations with additional authentication.Manual assessment
MASVS-NETWORK-1The app secures all network traffic according to current best practices.No static findings · not a pass
MASVS-NETWORK-2The app verifies the identity of the remote endpoint (e.g. certificate pinning).No static findings · not a pass
MASVS-PLATFORM-1The app uses IPC mechanisms securely.Review signal
MASVS-PLATFORM-2The app uses WebViews securely.No static findings · not a pass
MASVS-PLATFORM-3The app uses the user interface securely.Manual assessment
MASVS-CODE-1The app requires an up-to-date platform version.No static findings · not a pass
MASVS-CODE-2The app has a mechanism for enforcing updates.Manual assessment
MASVS-CODE-3The app only uses software components without known vulnerabilities.Review signal
MASVS-CODE-4The app validates and sanitizes all untrusted inputs and follows secure-coding practice.No static findings · not a pass
MASVS-RESILIENCE-1The app validates the integrity of the platform.Manual assessment
MASVS-RESILIENCE-2The app implements anti-tampering mechanisms.Manual assessment
MASVS-RESILIENCE-3The app implements anti-static-analysis mechanisms.Manual assessment
MASVS-RESILIENCE-4The app implements anti-dynamic-analysis techniques.Manual assessment
MASVS-PRIVACY-1The app minimizes access to sensitive data and resources.No static findings · not a pass
MASVS-PRIVACY-2The app prevents identification of the user.No static findings · not a pass
MASVS-PRIVACY-3The app is transparent about data collection and usage.No static findings · not a pass
MASVS-PRIVACY-4The app offers user control over their data.Manual assessment
Build identity and signature
Scan ID
d8cc7502-ce6c-456f-b4a2-8cc458823213
APK SHA-256
b5b32d345e043d60b7f0314a27539915cd0661c387dfed14c318691c4e7cde52
Capsule SHA-256
0ba7cb760581e4f9f9faece048a50bddd9ce290d2f17e9a2c0d729bed100308d
Signing key
IE6LeZNX4dAAPLGr

Verify the signed JSON at apk-scanner.com/verify. This printed view is a presentation of the signed record; the JSON is the verification artifact.