{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-79-basic_auth_url", "name": "BasicAuthUrl", "shortDescription": { "text": "Hard-coded credentials in a URL" }, "fullDescription": { "text": "Remove the embedded username:password, rotate the credential, and authenticate to the endpoint with short-lived per-user tokens instead." }, "helpUri": "https://apk-scanner.com/finding/basic_auth_url", "help": { "text": "Remove the embedded username:password, rotate the credential, and authenticate to the endpoint with short-lived per-user tokens instead." }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1", "MASVS-AUTH-1" ], "security-severity": "8.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1", "MASVS-AUTH-1" ] } }, { "id": "APKSCAN-1-s3_bucket", "name": "S3Bucket", "shortDescription": { "text": "Amazon S3 bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/s3_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-35-exported_provider", "name": "ExportedProvider", "shortDescription": { "text": "Exported ContentProvider without permission" }, "fullDescription": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "helpUri": "https://apk-scanner.com/finding/exported_provider", "help": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-926", "CWE-284", "MASVS-PLATFORM-1" ], "security-severity": "2.0", "cwe": [ "CWE-926", "CWE-284" ], "masvs": [ "MASVS-PLATFORM-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } } ] } }, "automationDetails": { "id": "apk-scanner/com.xt.retouchoversea/4ce42c80-2b64-4cd4-a22b-c5d6bb97a0d5" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-79-basic_auth_url", "level": "error", "message": { "text": "Hardcoded credentials in a URL" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libppsec.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "24d8839ff28a158928385a08664ed764f543bcd7b4f7ca5f97c5398228802494" }, "properties": { "severity": "high", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes2.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "463c368ace9b7b7b7438781fb50c1aaac0da6127536e2db9be68d2a944d8dd4c" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes2.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "7ae40f14c303524901666f1a2fc754dd588bb762949fb1f81986a345995b5e94" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes2.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "9c888d22e678d95bbf49d41cced79377cff6b8b9910cfedef16e7df3a370f964" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes2.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "c50d9534dfc9fa68a9f57f9216bb140bf887f27d5e9fdd96054c670a1f1ec854" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "classes2.dex" } } } ], "partialFingerprints": { "apkscanFingerprint": "1a15c18d0eaba12181ddb137a674b06b2591758e9274476e2548f1d681637193" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "48034afcc585ad4640466f2d2ff2eec55fced8a51af78f1e92b93b449096bc00" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "note", "message": { "text": "Exported content provider without permission (third-party library artifact, shared across 401 unrelated developers)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:com.facebook.FacebookContentProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "b369abc903581edba05e9ec1a5fc46d6b3e7ae316db05c5f7a90becac10e388b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "b38ed41e3ce278d4b20afbd869ba27f5bd2207ae87aaa0bb4e109deb995d1d1d" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "warning", "message": { "text": "Exported content provider without permission" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:retouch.debug.automation.DebugAutomationProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "b3a6bdb541916a651e93e177b103165b5a7718954a7ffb9db6fd4836d40080f2" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-confirmed" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 53001.417, "harvest": 17508.5859999999, "detectors": 29690.43299999996 }, "bytes_total": 342559304, "bytes_scanned": 342559304, "bytes_skipped": 0, "files_processed": 10379, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "e60ef34e8ed7875df50806d33a99f947f63c036b2b172c8779dc874044fd823a" }, { "name": "config.arm64_v8a.apk", "sha256": "4978b2c8e2f44d3f5c403405425329794c2d1bac3708fb499a3a7db66a1796fa" }, { "name": "config.xxhdpi.apk", "sha256": "1bbd5a70b17c898bcf7d2e6f00cdd724707843a56f45af5feeccce22ce9c3f6b" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "e60ef34e8ed7875df50806d33a99f947f63c036b2b172c8779dc874044fd823a", "app_id": "com.xt.retouchoversea", "app_title": "Hypic - Photo Editor & AI Art", "app_version": "9.6.0", "scan_id": "4ce42c80-2b64-4cd4-a22b-c5d6bb97a0d5", "scanned_at": "2026-10-11T01:30:19.156Z" } } ] }