{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-2-firebase_rtdb", "name": "FirebaseRtdb", "shortDescription": { "text": "Firebase Realtime Database reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_rtdb", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-77-ds_underdeclare", "name": "DsUnderdeclare", "shortDescription": { "text": "Data Safety label omits an observed data category" }, "fullDescription": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "helpUri": "https://apk-scanner.com/finding/ds_underdeclare", "help": { "text": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-359", "MASVS-PRIVACY-3" ], "security-severity": "2.0", "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-3" ] } }, { "id": "APKSCAN-57-short_key", "name": "ShortKey", "shortDescription": { "text": "Short signing key" }, "fullDescription": { "text": "Use an RSA key of at least 2048 bits or an EC P-256 key for signing." }, "helpUri": "https://apk-scanner.com/finding/short_key", "help": { "text": "Use an RSA key of at least 2048 bits or an EC P-256 key for signing." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "CWE-326", "MASVS-CRYPTO-1" ], "security-severity": "5.0", "cwe": [ "CWE-326" ], "masvs": [ "MASVS-CRYPTO-1" ] } } ] } }, "automationDetails": { "id": "apk-scanner/de.hafas.android.db/0a2855b1-3504-42f8-89ea-b751f09ce03d" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-2-firebase_rtdb", "level": "note", "message": { "text": "Firebase Realtime Database reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "d321f34928e510a5b47f5cb622fc5efa9f4bb67c7daa2e039801fa85a7d6b369" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "214c7298ca3ecfbc6e600a65197f2c07e1c3337c18abebacdb2141e8fc143ec0" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml" } } } ], "partialFingerprints": { "apkscanFingerprint": "34c6532009a3f5dc539f2466fe37436408b8b5b562403adf2a37bf87f25dab67" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "bbfbb88d8e3cc5eb646158a673b04eef88f7c687e02500de72ac02517d221978" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-77-ds_underdeclare", "level": "note", "message": { "text": "Data Safety label omits Location" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "data-safety:Location" } } } ], "partialFingerprints": { "apkscanFingerprint": "cacfd47daa7d0aafb7cbd1791f3964ef2850687203797b5e24429c41acdf7290" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-57-short_key", "level": "warning", "message": { "text": "Short signing key (RSA 1024-bit)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "META-INF/signing:key" } } } ], "partialFingerprints": { "apkscanFingerprint": "eff7d2f7607ae274d531546d1e828faf234bca919325efac0bbe80b2f250d041" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-confirmed" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 15400.599, "harvest": 3505.0349999999953, "detectors": 10307.608999999991 }, "bytes_total": 66384677, "bytes_scanned": 66384677, "bytes_skipped": 0, "files_processed": 3219, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "e080121449ba593d3a3b84a1ccdb9a6a5a8380230dbd7d641c08a98cf9a24065" }, { "name": "config.arm64_v8a.apk", "sha256": "85639d34b5a6a1745eab9d31f043120f599799335178d50ed53e6dad02191e8b" }, { "name": "config.xxhdpi.apk", "sha256": "26cb3035b5746a56dd06cc8d66ed086f24b613c1645e907e5e032d729bc51cc9" } ], "ruleset_sha256": "f845a46700295ef0c808b2accb30ba973aca62f3b52fef51e8489d1916061a63" }, "apk_sha256": "e080121449ba593d3a3b84a1ccdb9a6a5a8380230dbd7d641c08a98cf9a24065", "app_id": "de.hafas.android.db", "app_title": "DB Navigator", "app_version": "26.19.0", "scan_id": "0a2855b1-3504-42f8-89ea-b751f09ce03d", "scanned_at": "2026-10-14T04:42:26.295Z" } } ] }