{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-1-s3_bucket", "name": "S3Bucket", "shortDescription": { "text": "Amazon S3 bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/s3_bucket", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "9.5", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-31-slack_webhook", "name": "SlackWebhook", "shortDescription": { "text": "Slack incoming webhook URL" }, "fullDescription": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "helpUri": "https://apk-scanner.com/finding/slack_webhook", "help": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "8.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-2-firebase_rtdb", "name": "FirebaseRtdb", "shortDescription": { "text": "Firebase Realtime Database reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_rtdb", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-35-exported_provider", "name": "ExportedProvider", "shortDescription": { "text": "Exported ContentProvider without permission" }, "fullDescription": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "helpUri": "https://apk-scanner.com/finding/exported_provider", "help": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-926", "CWE-284", "MASVS-PLATFORM-1" ], "security-severity": "2.0", "cwe": [ "CWE-926", "CWE-284" ], "masvs": [ "MASVS-PLATFORM-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-57-short_key", "name": "ShortKey", "shortDescription": { "text": "Short signing key" }, "fullDescription": { "text": "Use an RSA key of at least 2048 bits or an EC P-256 key for signing." }, "helpUri": "https://apk-scanner.com/finding/short_key", "help": { "text": "Use an RSA key of at least 2048 bits or an EC P-256 key for signing." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "CWE-326", "MASVS-CRYPTO-1" ], "security-severity": "5.0", "cwe": [ "CWE-326" ], "masvs": [ "MASVS-CRYPTO-1" ] } } ] } }, "automationDetails": { "id": "apk-scanner/com.youmusic.magictiles/021a750d-4117-4a31-8c2b-66efeae1930a" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-1-s3_bucket", "level": "error", "message": { "text": "Amazon S3 bucket reference — confirmed publicly readable [live-verified]" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/bin/Data/Managed/Metadata/global-metadata.dat" } } } ], "partialFingerprints": { "apkscanFingerprint": "d94b520cf29d05f84ec71e76a85e9fe6501e81f6050debd415421fc6cbd44cda" }, "properties": { "severity": "critical", "verified": true, "relationship": "verified-exposure" } }, { "ruleId": "APKSCAN-31-slack_webhook", "level": "error", "message": { "text": "Slack incoming webhook URL" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/bin/Data/Managed/Metadata/global-metadata.dat" } } } ], "partialFingerprints": { "apkscanFingerprint": "de463265711cacdddbc6d377173e7b1812ceb4d46fbcac088e1bbaaad0780c22" }, "properties": { "severity": "high", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-31-slack_webhook", "level": "error", "message": { "text": "Slack incoming webhook URL" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/bin/Data/Managed/Metadata/global-metadata.dat" } } } ], "partialFingerprints": { "apkscanFingerprint": "fa6f5f0c3e0e531f3e2de4a76816fd97b7423c95d6e53fead90ee9a7b70dbe58" }, "properties": { "severity": "high", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/bin/Data/Managed/Metadata/global-metadata.dat" } } } ], "partialFingerprints": { "apkscanFingerprint": "7541133cd300fcce2de53014a1880ddcbe8f0aeea362a0f43a9662e87b2791c5" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/bin/Data/Managed/Metadata/global-metadata.dat" } } } ], "partialFingerprints": { "apkscanFingerprint": "2ee6d1d81f1441f59cd784f2ff3875b06fb7c1c9a5d42b8c8e1c6c52af2b5263" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "assets/bin/Data/Managed/Metadata/global-metadata.dat" } } } ], "partialFingerprints": { "apkscanFingerprint": "77ec7d9f17348a6e2858553a7b632da2e509f57b7e73087c10423fb61d15cbc2" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/cd90ac4618a4244a38928c9e5c40a5b9" } } } ], "partialFingerprints": { "apkscanFingerprint": "556d771bad64fe1eaa8665b09660548441b5adcc23dc896ff2323ee028279c72" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/cd90ac4618a4244a38928c9e5c40a5b9" } } } ], "partialFingerprints": { "apkscanFingerprint": "9918916635f57d7b0c0cec0aa505c4ccefa41cd87594b49fefd241c60b7f10b5" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/cd90ac4618a4244a38928c9e5c40a5b9" } } } ], "partialFingerprints": { "apkscanFingerprint": "fc8eafc30fe79aa25540875beb2d2a114d2776b3eed4d2344c63ea480c5d5bfb" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/cd90ac4618a4244a38928c9e5c40a5b9" } } } ], "partialFingerprints": { "apkscanFingerprint": "3beb136686c9b12a70148bdf8a23d52fc1716c2008392ad4e3c2f93446cbf4f1" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/cd90ac4618a4244a38928c9e5c40a5b9" } } } ], "partialFingerprints": { "apkscanFingerprint": "d9edafb76c3e4d2b808d6f29ee10000c812752b2dc2e3989e64411761ef2ef9f" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/cd90ac4618a4244a38928c9e5c40a5b9" } } } ], "partialFingerprints": { "apkscanFingerprint": "bdddfa85578ef5e75826ddef20c22fc20686b7d7558419b304cd6013067a0ba2" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/afeb451d9eceb496e9c0d41d5e0a4d00" } } } ], "partialFingerprints": { "apkscanFingerprint": "095a33ee7a2ec9bc100a879722e56524ff2b8a2db0496c38eef9650256cba05a" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/afeb451d9eceb496e9c0d41d5e0a4d00" } } } ], "partialFingerprints": { "apkscanFingerprint": "240698adbd270756718a4a57fa2af89bc823fc749bcb82ea7bde42644c8294fe" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/afeb451d9eceb496e9c0d41d5e0a4d00" } } } ], "partialFingerprints": { "apkscanFingerprint": "ef9930eea3055a3ba40ed1898c97dd28739f9181b8a3518e42f734a837a0fbd2" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/afeb451d9eceb496e9c0d41d5e0a4d00" } } } ], "partialFingerprints": { "apkscanFingerprint": "25a36cb4500a3c2b3a1684f3abc5ebace3cd134514e0ca0607e19757757f7624" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/cd90ac4618a4244a38928c9e5c40a5b9" } } } ], "partialFingerprints": { "apkscanFingerprint": "a3e2baafd4e8813553941bc6407c17c0f020dbbcea9ff29f5a970342ab481fc8" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/cd90ac4618a4244a38928c9e5c40a5b9" } } } ], "partialFingerprints": { "apkscanFingerprint": "c92c54c14ac8fa6c9c8460b79241f5c688a3b07d56aabb0e32f4c52cba2aecf6" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-1-s3_bucket", "level": "note", "message": { "text": "Amazon S3 bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_UnityDataAssetPack/assets/bin/Data/cd90ac4618a4244a38928c9e5c40a5b9" } } } ], "partialFingerprints": { "apkscanFingerprint": "3e17acd804869b2ce1bb77727f3a0a35982b7f122e6834cc86ed51980099fdf4" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-2-firebase_rtdb", "level": "note", "message": { "text": "Firebase Realtime Database reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "cacd978919ebeb6505e2a32a64452da752c005ef87a9f9fb0344f3f584307bee" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "459d3b95648799f9df7e32fc65dcfe4de566620ee1148ee297f1a934545b656f" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml" } } } ], "partialFingerprints": { "apkscanFingerprint": "6287b2b4d2a0ec6c51e7c5bd6fa601b4c1d13355640c184e58f6d8ae1b122e85" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "note", "message": { "text": "Exported content provider without permission (third-party library artifact, shared across 403 unrelated developers)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:com.facebook.FacebookContentProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "b369abc903581edba05e9ec1a5fc46d6b3e7ae316db05c5f7a90becac10e388b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "note", "message": { "text": "Exported content provider without permission (third-party library artifact, shared across 232 unrelated developers)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:ca.analytics.internal.PreloadInfoContentProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "e510d1eb34e8724fb89c83162bddb9cb7decb566898c4cfb5f1fc0556fb56332" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "google/api/backend.proto" } } } ], "partialFingerprints": { "apkscanFingerprint": "b6e2cb8eb4bf3d0a7bcb1c02e7aaa6b80181f3fefcd2655ab608c7c76f9d6977" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "google/api/endpoint.proto" } } } ], "partialFingerprints": { "apkscanFingerprint": "6da605c01a32d6178ae1e6876876e3de02277efaeb0bf30b781056b6efdcc7a8" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "7c3b8f94a69e4023d1a92cad85cedae0854c71227d9fee147f8ced5da0fe67cf" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-57-short_key", "level": "warning", "message": { "text": "Short signing key (RSA 1024-bit)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "META-INF/signing:key" } } } ], "partialFingerprints": { "apkscanFingerprint": "eff7d2f7607ae274d531546d1e828faf234bca919325efac0bbe80b2f250d041" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-confirmed" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 76147.27, "harvest": 35751.925000000025, "detectors": 35039.59299999933 }, "bytes_total": 728106593, "bytes_scanned": 728106593, "bytes_skipped": 0, "files_processed": 6081, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "504bbc6c6d9e1b92c8765ba9b42735745f7b705b901cba2760a1744dd3495ab7" }, { "name": "UnityDataAssetPack.apk", "sha256": "19cabd07c9f0b790af31366671e1a4ad2505265c2569afc225f01a10ad59a649" }, { "name": "config.arm64_v8a.apk", "sha256": "7abe2efd926034958dad9183034e1b90492ae346a541a8512e0dd907639e99ce" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "504bbc6c6d9e1b92c8765ba9b42735745f7b705b901cba2760a1744dd3495ab7", "app_id": "com.youmusic.magictiles", "app_title": "Magic Tiles 3™ - Piano Game", "app_version": "13.096.004", "scan_id": "021a750d-4117-4a31-8c2b-66efeae1930a", "scanned_at": "2026-10-08T20:23:16.216Z" } } ] }