{
  "app": {
    "app_id": "com.tutotoons.app.fluvsies.free",
    "title": "Fluvsies - Cute Virtual Pets",
    "version": "24.1.2"
  },
  "scan": {
    "scan_id": "3fb07cd1-0ccd-4d0b-a5e7-6725e47e24d7",
    "grade": "A",
    "score": 90,
    "scanned_at": "2026-10-08T12:29:45.034Z"
  },
  "analysis": {
    "issues": [],
    "stages": {
      "pii": "complete",
      "sbom": "complete",
      "signing": "certificate_parsed",
      "strings": "complete",
      "manifest": "complete"
    },
    "status": "complete",
    "grading": {
      "policy": "static-coverage-v1",
      "blockers": [],
      "eligible": true
    },
    "timings_ms": {
      "total": 41918.265,
      "harvest": 21439.774999999943,
      "detectors": 17486.716000000128
    },
    "bytes_total": 431734581,
    "bytes_scanned": 431734581,
    "bytes_skipped": 0,
    "files_processed": 2571,
    "coverage_version": 2,
    "string_encodings": [
      "ascii",
      "utf16le"
    ],
    "signature_validation": "not_performed"
  },
  "provenance": {
    "mode": "static",
    "artifacts": [
      {
        "name": "base.apk",
        "sha256": "a1aa7a27d6202d569de1ddf3c558cf39fe93aec96018433144a2381a6da1adb6"
      },
      {
        "name": "all_atlases.apk",
        "sha256": "4a5d52ca1acaf1dc4a37d2eb9d1b5657389ce82b600c1f6a00269b3896ab9bdd"
      },
      {
        "name": "all_materials.apk",
        "sha256": "04bff2fadd445864233fb359c74092da1bcea3010402d587c3ceae05e22df840"
      },
      {
        "name": "all_materials_with_textures.apk",
        "sha256": "e0dc75f43e5c786c1e6fb4083c519ae00e3d84e9e88e0b1d688790eed1124a5d"
      },
      {
        "name": "catroom_images.apk",
        "sha256": "156c5aba6bcb218405a0f5fef8ecbc5c96a3533b17fdfdcacb01af441a33bce5"
      },
      {
        "name": "config.arm64_v8a.apk",
        "sha256": "001218608d112002ec41c6ed8cc6b0b323ec29d4e0930e787bf02d007dc07b11"
      },
      {
        "name": "drawing_images.apk",
        "sha256": "8cc2f64de1233fa481af6c2276290b2cfcf11d7353a12735b3d5c96434f2f043"
      },
      {
        "name": "drawings.apk",
        "sha256": "cefab96b778566782f3c15d471cd8efe8f604fd999ca00af606601540edd4417"
      },
      {
        "name": "flying_background_data.apk",
        "sha256": "ad3d093f5ba99387689765bad60cf503b0f0238dbe2aa19da58db7b37a2517d3"
      },
      {
        "name": "flying_images.apk",
        "sha256": "55f5ae60b7963b1d46791b784407001e51a904be82641c147593bba696115d9b"
      },
      {
        "name": "iap_store_assets.apk",
        "sha256": "6a14b9c527f6df302c00e6b18e96240fa4bb197ab408db3595c022a53638ac65"
      },
      {
        "name": "lte_assets.apk",
        "sha256": "d9b94de3e871aedbfa57972ed0eb5b2fc402c92041a5179d22c47928efc7a415"
      },
      {
        "name": "main_images.apk",
        "sha256": "061a7b02140a611242ae1d9cd67861ac93b5b6bb0e16e998410e86f3ee84e4d1"
      },
      {
        "name": "main_toys.apk",
        "sha256": "e9ab35839a3b4888cf6269dda3d68bfa11ef8e95346ab699ce32ba0c67b9e613"
      },
      {
        "name": "music_tracks.apk",
        "sha256": "d763c45a859f0a3b3b6ee79d23ca93122a23094405d865531df46ca59a602b95"
      },
      {
        "name": "overworld_assets.apk",
        "sha256": "9990467553b83d3b601f23bbe7f28ba95b279da893883f5d4301decb328e8b50"
      },
      {
        "name": "overworld_sprites.apk",
        "sha256": "a1496d4b4c5011dc2ee8d5310716f126fa6b9877fd82afbcf20abb377f138115"
      },
      {
        "name": "room_shared.apk",
        "sha256": "fa3615e75c03123585e0518dad52d1c74090fb929941cbeb3ea82cf3f8041a28"
      },
      {
        "name": "sceneassetbundle.apk",
        "sha256": "fe870b322141b967e1a8f3ab8eb252fe796da59395fd819aa4c126b213a92725"
      },
      {
        "name": "sfx.apk",
        "sha256": "c346a79b10f4e50ac979ec54f2c89dfffc57a342b7491e35f22403a5dd53957f"
      },
      {
        "name": "static_atlases.apk",
        "sha256": "ecb55164fd98ec6d97a56b2b58627098640c3fb01d0378e54121169e1ceade39"
      },
      {
        "name": "static_customization_items_sprites.apk",
        "sha256": "566a0ea72ba3651cb2186493340090f3739837b00038725d1339ec2513bc8d6b"
      },
      {
        "name": "static_lte_assets.apk",
        "sha256": "e913ac0a36e5ba3d6ddf69b550832c33a5274126ebe79ca8e9f20306f23f3e80"
      },
      {
        "name": "static_materials.apk",
        "sha256": "a6db6ddc83af3f4301d754ba549a5cc98e63148bf149d3cf8b1cd46d94579735"
      },
      {
        "name": "static_plushies_sprites.apk",
        "sha256": "acf799de217446923756f0284e51851702bf675662d372e88612b22666909ebf"
      },
      {
        "name": "static_spine_skins_sprites.apk",
        "sha256": "11d003e26a304b0dc8bd41af4059c593ea48bd69d33ca06cdd423f7834ae75d3"
      },
      {
        "name": "textureassetbundle.apk",
        "sha256": "c70873e8d7f4a9cc8349e576adfcd732ee15cda4f29a46fd00485de2183fdd21"
      }
    ],
    "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e"
  },
  "apk_sha256": "a1aa7a27d6202d569de1ddf3c558cf39fe93aec96018433144a2381a6da1adb6",
  "schema": "apk-scanner.coverage/v1",
  "framework": "OWASP MASVS v2",
  "disclaimer": "Static, metadata-only analysis. Each control is scored evidence-for / gap-signal / requires-manual-testing. This is evidence toward a MASVS assessment, NOT a certification — apk-scanner.com is not an authorized assessment lab. Absence of a static finding does not prove a control passes.",
  "rows": [
    {
      "control": "MASVS-STORAGE-1",
      "category": "STORAGE",
      "title": "The app securely stores sensitive data.",
      "static": "partial",
      "status": "gap-detected",
      "count": 2,
      "findings": [
        {
          "finding_type": 20,
          "key": "google_api_key",
          "title": "Google API key (client-shipped; restriction unverified)",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            798
          ]
        },
        {
          "finding_type": 20,
          "key": "google_api_key",
          "title": "Google API key (client-shipped; restriction unverified)",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            798
          ]
        }
      ]
    },
    {
      "control": "MASVS-STORAGE-2",
      "category": "STORAGE",
      "title": "The app prevents leakage of sensitive data.",
      "static": "partial",
      "status": "gap-detected",
      "count": 6,
      "findings": [
        {
          "finding_type": 1,
          "key": "s3_bucket",
          "title": "Amazon S3 bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 1,
          "key": "s3_bucket",
          "title": "Amazon S3 bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 2,
          "key": "firebase_rtdb",
          "title": "Firebase Realtime Database reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 2,
          "key": "firebase_rtdb",
          "title": "Firebase Realtime Database reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 53,
          "key": "firebase_storage",
          "title": "Firebase Storage bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 53,
          "key": "firebase_storage",
          "title": "Firebase Storage bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        }
      ]
    },
    {
      "control": "MASVS-CRYPTO-1",
      "category": "CRYPTO",
      "title": "The app employs current strong cryptography and uses it according to best practices.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CRYPTO-2",
      "category": "CRYPTO",
      "title": "The app performs key management according to best practices.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-AUTH-1",
      "category": "AUTH",
      "title": "The app uses secure authentication and authorization protocols.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-AUTH-2",
      "category": "AUTH",
      "title": "The app performs local authentication securely.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-AUTH-3",
      "category": "AUTH",
      "title": "The app secures sensitive operations with additional authentication.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-NETWORK-1",
      "category": "NETWORK",
      "title": "The app secures all network traffic according to current best practices.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-NETWORK-2",
      "category": "NETWORK",
      "title": "The app verifies the identity of the remote endpoint (e.g. certificate pinning).",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PLATFORM-1",
      "category": "PLATFORM",
      "title": "The app uses IPC mechanisms securely.",
      "static": "yes",
      "status": "gap-detected",
      "count": 1,
      "findings": [
        {
          "finding_type": 35,
          "key": "exported_provider",
          "title": "Exported content provider without permission",
          "severity": "medium",
          "verified": false,
          "relationship": "gap-confirmed",
          "cwe": [
            926,
            284
          ]
        }
      ]
    },
    {
      "control": "MASVS-PLATFORM-2",
      "category": "PLATFORM",
      "title": "The app uses WebViews securely.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PLATFORM-3",
      "category": "PLATFORM",
      "title": "The app uses the user interface securely.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-1",
      "category": "CODE",
      "title": "The app requires an up-to-date platform version.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-2",
      "category": "CODE",
      "title": "The app has a mechanism for enforcing updates.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-3",
      "category": "CODE",
      "title": "The app only uses software components without known vulnerabilities.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-4",
      "category": "CODE",
      "title": "The app validates and sanitizes all untrusted inputs and follows secure-coding practice.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-1",
      "category": "RESILIENCE",
      "title": "The app validates the integrity of the platform.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-2",
      "category": "RESILIENCE",
      "title": "The app implements anti-tampering mechanisms.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-3",
      "category": "RESILIENCE",
      "title": "The app implements anti-static-analysis mechanisms.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-4",
      "category": "RESILIENCE",
      "title": "The app implements anti-dynamic-analysis techniques.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-1",
      "category": "PRIVACY",
      "title": "The app minimizes access to sensitive data and resources.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-2",
      "category": "PRIVACY",
      "title": "The app prevents identification of the user.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-3",
      "category": "PRIVACY",
      "title": "The app is transparent about data collection and usage.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-4",
      "category": "PRIVACY",
      "title": "The app offers user control over their data.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    }
  ],
  "categories": [
    {
      "category": "STORAGE",
      "controls": 2,
      "gaps": 2,
      "verified": 0,
      "manual": 0
    },
    {
      "category": "CRYPTO",
      "controls": 2,
      "gaps": 0,
      "verified": 0,
      "manual": 0
    },
    {
      "category": "AUTH",
      "controls": 3,
      "gaps": 0,
      "verified": 0,
      "manual": 3
    },
    {
      "category": "NETWORK",
      "controls": 2,
      "gaps": 0,
      "verified": 0,
      "manual": 0
    },
    {
      "category": "PLATFORM",
      "controls": 3,
      "gaps": 1,
      "verified": 0,
      "manual": 1
    },
    {
      "category": "CODE",
      "controls": 4,
      "gaps": 0,
      "verified": 0,
      "manual": 1
    },
    {
      "category": "RESILIENCE",
      "controls": 4,
      "gaps": 0,
      "verified": 0,
      "manual": 4
    },
    {
      "category": "PRIVACY",
      "controls": 4,
      "gaps": 0,
      "verified": 0,
      "manual": 1
    }
  ]
}