{
  "app": {
    "app_id": "com.tiltingpoint.spongebob",
    "title": "SpongeBob: Krusty Cook-Off",
    "version": "5.12.0"
  },
  "scan": {
    "scan_id": "7e7d50b6-e7ee-4162-9e62-496d94dc526f",
    "grade": "F",
    "score": 33,
    "scanned_at": "2026-09-29T13:11:13.614Z"
  },
  "analysis": {
    "issues": [],
    "stages": {
      "pii": "complete",
      "sbom": "complete",
      "signing": "certificate_parsed",
      "strings": "complete",
      "manifest": "complete"
    },
    "status": "complete",
    "grading": {
      "policy": "static-coverage-v1",
      "blockers": [],
      "eligible": true
    },
    "timings_ms": {
      "total": 43972.176,
      "harvest": 19892.970999999994,
      "detectors": 21746.11599999937
    },
    "bytes_total": 437218459,
    "bytes_scanned": 437218459,
    "bytes_skipped": 0,
    "files_processed": 2155,
    "coverage_version": 2,
    "string_encodings": [
      "ascii",
      "utf16le"
    ],
    "signature_validation": "not_performed"
  },
  "provenance": {
    "mode": "static",
    "artifacts": [
      {
        "name": "base.apk",
        "sha256": "c521749c3fdcd2fe05fd9e7366c62fcd311c3b420af1f913e85b90c30df9f9dc"
      },
      {
        "name": "city_rest_common.apk",
        "sha256": "04a36f2f2767cf0f8f2e0f2e6d5a23c273c645ec0b19997a3361e1113ed44dd1"
      },
      {
        "name": "common_ui.apk",
        "sha256": "4d5de1d25402e453cf396bc9a473697f7bc46a5455b8365d5a385c03992e5c0b"
      },
      {
        "name": "config.arm64_v8a.apk",
        "sha256": "7f32a31a65cb7bdf35f5a218bbb8cc719e9a0eac61cf4b650da4e8b34c9b6e88"
      },
      {
        "name": "fonts.apk",
        "sha256": "06ff1fd9724b07204102b9075b63f69f0ff07a584b151fedc35827428577c71b"
      },
      {
        "name": "ftue.apk",
        "sha256": "837f852d5dbfb2e493dccf68e93e1c90c1703785740d2d67c62085147abcb087"
      },
      {
        "name": "gamedata.apk",
        "sha256": "10e240ce01c2d2d903689f281df57671ba6acfd9ceb996bf436e1bf3003161c7"
      },
      {
        "name": "patrick.apk",
        "sha256": "4fd21028b15de8ca1d217e4fecb6c1d7986213472477793bf0df66abd84a852f"
      },
      {
        "name": "sandy.apk",
        "sha256": "99a62520b599c934f7a14d4d5b3c393e105c644d8e507cdc433d4431084f289e"
      },
      {
        "name": "spine_common.apk",
        "sha256": "4819f0ca4f318e84ebe94351004e0624ba6d712b30626eb126c9770281de6573"
      },
      {
        "name": "spine_patrick.apk",
        "sha256": "2a55b3098374f418d149c544178eae0334a45ef99418a7e05f9d7cc36b67a237"
      },
      {
        "name": "spine_sandy.apk",
        "sha256": "2c264aa02bb4a885ff70c6ae50dfcf8a990f96e4cb00909b5432d2f4e336b92f"
      },
      {
        "name": "spine_spongebob.apk",
        "sha256": "e792af76d8608b0e40fe2bea7eca8a1a41abbbcd52c475ae61d0243c5798bc63"
      },
      {
        "name": "spine_squidward.apk",
        "sha256": "e0fe92bf271fa215591a839a1a2d1b17ec76d2b09b8c56b9618b66a00fd1db07"
      },
      {
        "name": "spongebob.apk",
        "sha256": "5e55ea3fddd4ae59e512c01133b0c28a6ca82356bb006b96659e06f2d20412b7"
      },
      {
        "name": "squidward.apk",
        "sha256": "2eb280311a777388f1603906549b3392b850fa7bbbe9b4359245a123b8d1b5a7"
      }
    ],
    "ruleset_sha256": "69544396ce47de08b97fb3d04080662e1cbb38c704bd5aa3d4b7e5489cde22e8"
  },
  "apk_sha256": "c521749c3fdcd2fe05fd9e7366c62fcd311c3b420af1f913e85b90c30df9f9dc",
  "schema": "apk-scanner.coverage/v1",
  "framework": "OWASP MASVS v2",
  "disclaimer": "Static, metadata-only analysis. Each control is scored evidence-for / gap-signal / requires-manual-testing. This is evidence toward a MASVS assessment, NOT a certification — apk-scanner.com is not an authorized assessment lab. Absence of a static finding does not prove a control passes.",
  "rows": [
    {
      "control": "MASVS-STORAGE-1",
      "category": "STORAGE",
      "title": "The app securely stores sensitive data.",
      "static": "partial",
      "status": "gap-detected",
      "count": 3,
      "findings": [
        {
          "finding_type": 20,
          "key": "google_api_key",
          "title": "Google API key (client-shipped; restriction unverified)",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            798
          ]
        },
        {
          "finding_type": 20,
          "key": "google_api_key",
          "title": "Google API key (client-shipped; restriction unverified)",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            798
          ]
        },
        {
          "finding_type": 37,
          "key": "allow_backup",
          "title": "Application data is backup-enabled",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            530,
            312
          ]
        }
      ]
    },
    {
      "control": "MASVS-STORAGE-2",
      "category": "STORAGE",
      "title": "The app prevents leakage of sensitive data.",
      "static": "partial",
      "status": "verified-exposure",
      "count": 8,
      "findings": [
        {
          "finding_type": 1,
          "key": "s3_bucket",
          "title": "Amazon S3 bucket reference — confirmed publicly readable",
          "severity": "critical",
          "verified": true,
          "relationship": "verified-exposure",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 1,
          "key": "s3_bucket",
          "title": "Amazon S3 bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 1,
          "key": "s3_bucket",
          "title": "Amazon S3 bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 1,
          "key": "s3_bucket",
          "title": "Amazon S3 bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 1,
          "key": "s3_bucket",
          "title": "Amazon S3 bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 2,
          "key": "firebase_rtdb",
          "title": "Firebase Realtime Database reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 37,
          "key": "allow_backup",
          "title": "Application data is backup-enabled",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            530,
            312
          ]
        },
        {
          "finding_type": 53,
          "key": "firebase_storage",
          "title": "Firebase Storage bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        }
      ]
    },
    {
      "control": "MASVS-CRYPTO-1",
      "category": "CRYPTO",
      "title": "The app employs current strong cryptography and uses it according to best practices.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CRYPTO-2",
      "category": "CRYPTO",
      "title": "The app performs key management according to best practices.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-AUTH-1",
      "category": "AUTH",
      "title": "The app uses secure authentication and authorization protocols.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-AUTH-2",
      "category": "AUTH",
      "title": "The app performs local authentication securely.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-AUTH-3",
      "category": "AUTH",
      "title": "The app secures sensitive operations with additional authentication.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-NETWORK-1",
      "category": "NETWORK",
      "title": "The app secures all network traffic according to current best practices.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-NETWORK-2",
      "category": "NETWORK",
      "title": "The app verifies the identity of the remote endpoint (e.g. certificate pinning).",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PLATFORM-1",
      "category": "PLATFORM",
      "title": "The app uses IPC mechanisms securely.",
      "static": "yes",
      "status": "gap-detected",
      "count": 1,
      "findings": [
        {
          "finding_type": 35,
          "key": "exported_provider",
          "title": "Exported content provider without permission (third-party library artifact, shared across 401 unrelated developers)",
          "severity": "low",
          "verified": false,
          "relationship": "gap-confirmed",
          "cwe": [
            926,
            284
          ]
        }
      ]
    },
    {
      "control": "MASVS-PLATFORM-2",
      "category": "PLATFORM",
      "title": "The app uses WebViews securely.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PLATFORM-3",
      "category": "PLATFORM",
      "title": "The app uses the user interface securely.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-1",
      "category": "CODE",
      "title": "The app requires an up-to-date platform version.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-2",
      "category": "CODE",
      "title": "The app has a mechanism for enforcing updates.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-3",
      "category": "CODE",
      "title": "The app only uses software components without known vulnerabilities.",
      "static": "yes",
      "status": "gap-detected",
      "count": 1,
      "findings": [
        {
          "finding_type": 62,
          "key": "sbom_cve",
          "title": "com.squareup.okhttp3:okhttp 3.12.13 — CVE-2021-0341",
          "severity": "medium",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            937,
            1104
          ]
        }
      ]
    },
    {
      "control": "MASVS-CODE-4",
      "category": "CODE",
      "title": "The app validates and sanitizes all untrusted inputs and follows secure-coding practice.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-1",
      "category": "RESILIENCE",
      "title": "The app validates the integrity of the platform.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-2",
      "category": "RESILIENCE",
      "title": "The app implements anti-tampering mechanisms.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-3",
      "category": "RESILIENCE",
      "title": "The app implements anti-static-analysis mechanisms.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-4",
      "category": "RESILIENCE",
      "title": "The app implements anti-dynamic-analysis techniques.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-1",
      "category": "PRIVACY",
      "title": "The app minimizes access to sensitive data and resources.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-2",
      "category": "PRIVACY",
      "title": "The app prevents identification of the user.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-3",
      "category": "PRIVACY",
      "title": "The app is transparent about data collection and usage.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-4",
      "category": "PRIVACY",
      "title": "The app offers user control over their data.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    }
  ],
  "categories": [
    {
      "category": "STORAGE",
      "controls": 2,
      "gaps": 2,
      "verified": 1,
      "manual": 0
    },
    {
      "category": "CRYPTO",
      "controls": 2,
      "gaps": 0,
      "verified": 0,
      "manual": 0
    },
    {
      "category": "AUTH",
      "controls": 3,
      "gaps": 0,
      "verified": 0,
      "manual": 3
    },
    {
      "category": "NETWORK",
      "controls": 2,
      "gaps": 0,
      "verified": 0,
      "manual": 0
    },
    {
      "category": "PLATFORM",
      "controls": 3,
      "gaps": 1,
      "verified": 0,
      "manual": 1
    },
    {
      "category": "CODE",
      "controls": 4,
      "gaps": 1,
      "verified": 0,
      "manual": 1
    },
    {
      "category": "RESILIENCE",
      "controls": 4,
      "gaps": 0,
      "verified": 0,
      "manual": 4
    },
    {
      "category": "PRIVACY",
      "controls": 4,
      "gaps": 0,
      "verified": 0,
      "manual": 1
    }
  ]
}