apk-scanner.com

Philadelphia Eagles

com.yinzcam.nfl.eagles · Build 3.9.7

Analysis: complete. Static analysis completed for this build. A grade is not a guarantee of safety. Historical verification does not establish current reachability.

Grade / score
B · 86/100
Finding categories
10
Occurrences
63
Scanned
2026-10-11T15:14:35.112Z
Document issued
2026-10-13T15:54:40.217Z
Historical verifications
0

Finding evidence

Open a category to review its occurrences. Printing includes all categories and occurrences.

Application data is backup-enabled · info · 1 occurrence

Backup is on by default on Android; this manifest states it explicitly. If the app stores sensitive local data, define dataExtractionRules/fullBackupContent to exclude it, or set android:allowBackup=false.

CWE-530 · CWE-312 · MASVS-STORAGE-1 · MASVS-STORAGE-2

  • android:allowBackup="true"
Amazon S3 bucket reference · low · 49 occurrences

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

  • https://█████████████.yinzcam.com.s3.amazonaws.com/███
  • https://████████████.yinzcam.com.s3.amazonaws.com/███
  • https://█████████████.yinzcam.com.s3.amazonaws.com/███
  • https://█████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • http://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.us-east-1.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://█████████████.yinzcam.com.s3.amazonaws.com/███
  • https://█████████████.yinzcam.com.s3.amazonaws.com/███
  • https://█████████████.yinzcam.com.s3.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • https://████████████████.s3.amazonaws.com/███
  • http://████████████████.s3.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
  • https://████.amazonaws.com/███
Firebase Realtime Database reference · low · 1 occurrence

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

  • https://████████████████████████.firebaseio.com/███
Private key material (third-party library artifact, shared across 34 unrelated developers) · low · 4 occurrences

Never ship private-key material in a client. Revoke/rotate the compromised key and hold it server-side or in a hardware-backed store.

CWE-321 · MASVS-CRYPTO-2

  • -----BEGIN PRIVATE KEY----- (redacted)
  • -----BEGIN PRIVATE KEY----- (redacted)
  • -----BEGIN PRIVATE KEY----- (redacted)
  • -----BEGIN PRIVATE KEY----- (redacted)
Google API key (client-shipped; restriction unverified) · low · 2 occurrences

Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control.

CWE-798 · MASVS-STORAGE-1

  • AIza•••••••• (21–40 chars, redacted)
  • AIza•••••••• (21–40 chars, redacted)
Exported content provider without permission (third-party library artifact, shared across 8 unrelated developers) · low · 2 occurrences

Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly.

CWE-926 · CWE-284 · MASVS-PLATFORM-1

  • TmxThirdPartyTicketContentProvider (exported, no permission)
  • ImageProvider (exported, no permission)
Firebase Storage bucket reference · low · 1 occurrence

Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open.

CWE-200 · CWE-284 · MASVS-STORAGE-2

  • ████████████
Background location access with advertising SDKs present · low · 1 occurrence

Justify background location; request foreground-only where possible and disclose the use in the Play Data Safety form.

CWE-359 · MASVS-PRIVACY-1

  • background location + ad SDKs
Data Safety label omits Contacts · low · 1 occurrence

Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected.

CWE-359 · MASVS-PRIVACY-3

  • app can access contacts (Contacts); not in the declaration
Short signing key (RSA 1024-bit) · medium · 1 occurrence

Use an RSA key of at least 2048 bits or an EC P-256 key for signing.

CWE-326 · MASVS-CRYPTO-1

  • RSA-1024

Control coverage

Mapped static evidence does not establish a control pass. Manual assessment remains separate.

ControlRequirementRecorded status
MASVS-STORAGE-1The app securely stores sensitive data.Review signal
MASVS-STORAGE-2The app prevents leakage of sensitive data.Review signal
MASVS-CRYPTO-1The app employs current strong cryptography and uses it according to best practices.Review signal
MASVS-CRYPTO-2The app performs key management according to best practices.Review signal
MASVS-AUTH-1The app uses secure authentication and authorization protocols.Manual assessment
MASVS-AUTH-2The app performs local authentication securely.Manual assessment
MASVS-AUTH-3The app secures sensitive operations with additional authentication.Manual assessment
MASVS-NETWORK-1The app secures all network traffic according to current best practices.No static findings · not a pass
MASVS-NETWORK-2The app verifies the identity of the remote endpoint (e.g. certificate pinning).No static findings · not a pass
MASVS-PLATFORM-1The app uses IPC mechanisms securely.Review signal
MASVS-PLATFORM-2The app uses WebViews securely.No static findings · not a pass
MASVS-PLATFORM-3The app uses the user interface securely.Manual assessment
MASVS-CODE-1The app requires an up-to-date platform version.No static findings · not a pass
MASVS-CODE-2The app has a mechanism for enforcing updates.Manual assessment
MASVS-CODE-3The app only uses software components without known vulnerabilities.No static findings · not a pass
MASVS-CODE-4The app validates and sanitizes all untrusted inputs and follows secure-coding practice.No static findings · not a pass
MASVS-RESILIENCE-1The app validates the integrity of the platform.Manual assessment
MASVS-RESILIENCE-2The app implements anti-tampering mechanisms.Manual assessment
MASVS-RESILIENCE-3The app implements anti-static-analysis mechanisms.Manual assessment
MASVS-RESILIENCE-4The app implements anti-dynamic-analysis techniques.Manual assessment
MASVS-PRIVACY-1The app minimizes access to sensitive data and resources.Review signal
MASVS-PRIVACY-2The app prevents identification of the user.No static findings · not a pass
MASVS-PRIVACY-3The app is transparent about data collection and usage.Review signal
MASVS-PRIVACY-4The app offers user control over their data.Manual assessment
Build identity and signature
Scan ID
873f3f96-9b4c-4e65-9bf6-f88f3babd709
APK SHA-256
e4f9afc6e3dd0c35bd089b62879091899c4b21d374c4cb4721bdd24a571507ed
Capsule SHA-256
72fa5b9f86edba6fc7ccc10abb1d6a34f2e33dcfabe50db7ee3ba90a8c70d401
Signing key
IE6LeZNX4dAAPLGr

Verify the signed JSON at apk-scanner.com/verify. This printed view is a presentation of the signed record; the JSON is the verification artifact.