{
  "app": {
    "app_id": "com.ubercab",
    "title": "Uber: Rides, eats, hotels",
    "version": "4.652.10004"
  },
  "scan": {
    "scan_id": "44dd9e5a-6275-4072-ae97-cd6999a0f19d",
    "grade": "B",
    "score": 84,
    "scanned_at": "2026-10-14T03:05:54.858Z"
  },
  "analysis": {
    "issues": [],
    "stages": {
      "pii": "complete",
      "sbom": "complete",
      "signing": "certificate_parsed",
      "strings": "complete",
      "manifest": "complete"
    },
    "status": "complete",
    "grading": {
      "policy": "static-coverage-v1",
      "blockers": [],
      "eligible": true
    },
    "timings_ms": {
      "total": 61278.35,
      "harvest": 13854.998999999932,
      "detectors": 41463.50599999971
    },
    "bytes_total": 260492318,
    "bytes_scanned": 260492318,
    "bytes_skipped": 0,
    "files_processed": 13304,
    "coverage_version": 2,
    "string_encodings": [
      "ascii",
      "utf16le"
    ],
    "signature_validation": "not_performed"
  },
  "provenance": {
    "mode": "static",
    "artifacts": [
      {
        "name": "base.apk",
        "sha256": "d804dc74bbee00da71eec7a2b6a8c91fa484d9565cba436fe711cead96faad43"
      },
      {
        "name": "BarcodeScanner.apk",
        "sha256": "54e39913ee427a9f2e0e78b96111dbcc7e60bdc40e83eed871775e94ad117330"
      },
      {
        "name": "BarcodeScanner.config.arm64_v8a.apk",
        "sha256": "0f168d0e3db90abe8098ef9dccd9087be85c3a9b3d454b46b59bcf54840b6b12"
      },
      {
        "name": "CarRentalsDFMApi.apk",
        "sha256": "9bc9b508899bf15d422de082678e66c715edead22cbab6787a83d1f1a1093a30"
      },
      {
        "name": "EatsDFMAPI.apk",
        "sha256": "6c37aeea9597fe7c30c6b40222b3f270fd3837d6256748fa80fcfb04368cc851"
      },
      {
        "name": "EatsDFMViewAPI.apk",
        "sha256": "3ed5a95a543bdcca4153de1f3f36b9de407357733aa200afd3083724003ffb44"
      },
      {
        "name": "FlashNacional.apk",
        "sha256": "e1e5fa5e1b06f5dbaf0b9ebd589ae8195c52772712b2d519e4c6b2f6e69abcdc"
      },
      {
        "name": "GooglePaySdk.apk",
        "sha256": "4f6193696fb364a372c70240571a845eec5187072e11960182c8d7306602ad2d"
      },
      {
        "name": "VoipTwilio.apk",
        "sha256": "2f644ef397b04568f7ece85e72e023f9ccab16dcd9b409376460546b55487519"
      },
      {
        "name": "VoipTwilio.config.arm64_v8a.apk",
        "sha256": "7be3f86da58207ee33fd5a42cbf7b8a8c356393bea41284f5fcac1587ae75fde"
      },
      {
        "name": "config.arm64_v8a.apk",
        "sha256": "99e13421b86b2b6fc3a2fa0b11f39e86a2a04cc9dafc33a2799027ce313b1863"
      },
      {
        "name": "config.en.apk",
        "sha256": "8e7bb5aa60bd4279d7f1462177ff4763f0bcc504e983e8ce3172a6c3354a0b5f"
      },
      {
        "name": "config.xxhdpi.apk",
        "sha256": "3d2404ace9205b746812e98fa5b7784361479a9e33181486a4a4e7f68be4254a"
      }
    ],
    "ruleset_sha256": "f845a46700295ef0c808b2accb30ba973aca62f3b52fef51e8489d1916061a63"
  },
  "apk_sha256": "d804dc74bbee00da71eec7a2b6a8c91fa484d9565cba436fe711cead96faad43",
  "schema": "apk-scanner.coverage/v1",
  "framework": "OWASP MASVS v2",
  "disclaimer": "Static, metadata-only analysis. Each control is scored evidence-for / gap-signal / requires-manual-testing. This is evidence toward a MASVS assessment, NOT a certification — apk-scanner.com is not an authorized assessment lab. Absence of a static finding does not prove a control passes.",
  "rows": [
    {
      "control": "MASVS-STORAGE-1",
      "category": "STORAGE",
      "title": "The app securely stores sensitive data.",
      "static": "partial",
      "status": "gap-detected",
      "count": 2,
      "findings": [
        {
          "finding_type": 20,
          "key": "google_api_key",
          "title": "Google API key (client-shipped; restriction unverified)",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            798
          ]
        },
        {
          "finding_type": 20,
          "key": "google_api_key",
          "title": "Google API key (client-shipped; restriction unverified)",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            798
          ]
        }
      ]
    },
    {
      "control": "MASVS-STORAGE-2",
      "category": "STORAGE",
      "title": "The app prevents leakage of sensitive data.",
      "static": "partial",
      "status": "gap-detected",
      "count": 6,
      "findings": [
        {
          "finding_type": 1,
          "key": "s3_bucket",
          "title": "Amazon S3 bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 2,
          "key": "firebase_rtdb",
          "title": "Firebase Realtime Database reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 53,
          "key": "firebase_storage",
          "title": "Firebase Storage bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 53,
          "key": "firebase_storage",
          "title": "Firebase Storage bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 53,
          "key": "firebase_storage",
          "title": "Firebase Storage bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        },
        {
          "finding_type": 53,
          "key": "firebase_storage",
          "title": "Firebase Storage bucket reference",
          "severity": "low",
          "verified": false,
          "relationship": "gap-signal",
          "cwe": [
            200,
            284
          ]
        }
      ]
    },
    {
      "control": "MASVS-CRYPTO-1",
      "category": "CRYPTO",
      "title": "The app employs current strong cryptography and uses it according to best practices.",
      "static": "partial",
      "status": "gap-detected",
      "count": 1,
      "findings": [
        {
          "finding_type": 57,
          "key": "short_key",
          "title": "Short signing key (RSA 1024-bit)",
          "severity": "medium",
          "verified": false,
          "relationship": "gap-confirmed",
          "cwe": [
            326
          ]
        }
      ]
    },
    {
      "control": "MASVS-CRYPTO-2",
      "category": "CRYPTO",
      "title": "The app performs key management according to best practices.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-AUTH-1",
      "category": "AUTH",
      "title": "The app uses secure authentication and authorization protocols.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-AUTH-2",
      "category": "AUTH",
      "title": "The app performs local authentication securely.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-AUTH-3",
      "category": "AUTH",
      "title": "The app secures sensitive operations with additional authentication.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-NETWORK-1",
      "category": "NETWORK",
      "title": "The app secures all network traffic according to current best practices.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-NETWORK-2",
      "category": "NETWORK",
      "title": "The app verifies the identity of the remote endpoint (e.g. certificate pinning).",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PLATFORM-1",
      "category": "PLATFORM",
      "title": "The app uses IPC mechanisms securely.",
      "static": "yes",
      "status": "gap-detected",
      "count": 3,
      "findings": [
        {
          "finding_type": 35,
          "key": "exported_provider",
          "title": "Exported content provider without permission",
          "severity": "medium",
          "verified": false,
          "relationship": "gap-confirmed",
          "cwe": [
            926,
            284
          ]
        },
        {
          "finding_type": 35,
          "key": "exported_provider",
          "title": "Exported content provider without permission",
          "severity": "medium",
          "verified": false,
          "relationship": "gap-confirmed",
          "cwe": [
            926,
            284
          ]
        },
        {
          "finding_type": 35,
          "key": "exported_provider",
          "title": "Exported content provider without permission",
          "severity": "medium",
          "verified": false,
          "relationship": "gap-confirmed",
          "cwe": [
            926,
            284
          ]
        }
      ]
    },
    {
      "control": "MASVS-PLATFORM-2",
      "category": "PLATFORM",
      "title": "The app uses WebViews securely.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PLATFORM-3",
      "category": "PLATFORM",
      "title": "The app uses the user interface securely.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-1",
      "category": "CODE",
      "title": "The app requires an up-to-date platform version.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-2",
      "category": "CODE",
      "title": "The app has a mechanism for enforcing updates.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-3",
      "category": "CODE",
      "title": "The app only uses software components without known vulnerabilities.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-CODE-4",
      "category": "CODE",
      "title": "The app validates and sanitizes all untrusted inputs and follows secure-coding practice.",
      "static": "partial",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-1",
      "category": "RESILIENCE",
      "title": "The app validates the integrity of the platform.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-2",
      "category": "RESILIENCE",
      "title": "The app implements anti-tampering mechanisms.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-3",
      "category": "RESILIENCE",
      "title": "The app implements anti-static-analysis mechanisms.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-RESILIENCE-4",
      "category": "RESILIENCE",
      "title": "The app implements anti-dynamic-analysis techniques.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-1",
      "category": "PRIVACY",
      "title": "The app minimizes access to sensitive data and resources.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-2",
      "category": "PRIVACY",
      "title": "The app prevents identification of the user.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-3",
      "category": "PRIVACY",
      "title": "The app is transparent about data collection and usage.",
      "static": "yes",
      "status": "no-static-findings",
      "count": 0,
      "findings": []
    },
    {
      "control": "MASVS-PRIVACY-4",
      "category": "PRIVACY",
      "title": "The app offers user control over their data.",
      "static": "manual",
      "status": "requires-manual-testing",
      "count": 0,
      "findings": []
    }
  ],
  "categories": [
    {
      "category": "STORAGE",
      "controls": 2,
      "gaps": 2,
      "verified": 0,
      "manual": 0
    },
    {
      "category": "CRYPTO",
      "controls": 2,
      "gaps": 1,
      "verified": 0,
      "manual": 0
    },
    {
      "category": "AUTH",
      "controls": 3,
      "gaps": 0,
      "verified": 0,
      "manual": 3
    },
    {
      "category": "NETWORK",
      "controls": 2,
      "gaps": 0,
      "verified": 0,
      "manual": 0
    },
    {
      "category": "PLATFORM",
      "controls": 3,
      "gaps": 1,
      "verified": 0,
      "manual": 1
    },
    {
      "category": "CODE",
      "controls": 4,
      "gaps": 0,
      "verified": 0,
      "manual": 1
    },
    {
      "category": "RESILIENCE",
      "controls": 4,
      "gaps": 0,
      "verified": 0,
      "manual": 4
    },
    {
      "category": "PRIVACY",
      "controls": 4,
      "gaps": 0,
      "verified": 0,
      "manual": 1
    }
  ]
}