{ "capsule": { "schema": "apk-scanner.proof/v2", "issuer": "apk-scanner.com", "issued_at": "2026-10-13T20:40:58.719Z", "app": { "app_id": "digital.wmt.mobile.android.iowahawkeyes", "title": "Iowa Hawkeyes", "version": "2.1.9" }, "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 21059.375, "harvest": 5414.420999999999, "detectors": 14821.58400000003 }, "bytes_total": 105224079, "bytes_scanned": 105224079, "bytes_skipped": 0, "files_processed": 1298, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "007d6013a5f399b8eb4fe39a464a30fae77226c4eb3d439a074ea6b5c5f3c1a3" }, { "name": "config.arm64_v8a.apk", "sha256": "b92a821eb7efe2e4e7da9260afe853583fb0ea66e541dcf0f10b7db76f91832b" }, { "name": "config.en.apk", "sha256": "8740e7cf4f4a317ad73c2a128658eab8a5af67bdf69a3bbdea78ae088d61d839" }, { "name": "config.xxhdpi.apk", "sha256": "0520122b13734786fba425551a555676a903c8fd12c645b212ee940cfa373515" } ], "ruleset_sha256": "3bb79cc3710b0fb021feaa322578f4cffe08396a97c51b34df092b5a05891d5e" }, "apk_sha256": "007d6013a5f399b8eb4fe39a464a30fae77226c4eb3d439a074ea6b5c5f3c1a3", "scan": { "scan_id": "c4d70052-f67f-467a-ac55-60484690d2ea", "scanned_at": "2026-10-10T01:32:21.955Z", "grade": "B", "score": 87 }, "apk_signer": { "scheme": "v3", "subject_o": "Google Inc.", "subject_cn": "Android", "sha256": "33c0654a1de82b42a6e8341e57f52b44208287fec5b9b7255a01cbb63797c27b", "not_after": "2051-01-07T17:19:14+00:00" }, "counts": { "critical": 0, "high": 0, "medium": 1, "low": 132 }, "findings": [ { "finding_type": 2, "severity": "low", "title": "Firebase Realtime Database reference", "redacted_display": "https://█████████████████.firebaseio.com/███", "fingerprint": "4726af5936eaa67be3162be7c1dfc96c9c8c394ee20f07e904cfdeea5e6948ef", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8ac4debc98ad1c4d0aecd9e873ba15738f060b9afd091519971462c3dc07692b", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "9b67c05d957ac1f90764641b1e658aa032913bcab2ef2cc0062bb434e1f1bd19", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "13474c9f5071a10e1359b6570078a385e157a241350adb4bf4bd9aee655530fe", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "37b9b369715da912909238c32fbf4b78f1a950c25c342f7e556255cc1088a632", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "879b6ce345bacdbf5149f0af37fe10571f8da4816e2a0fdc5ae737944711e06e", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "feb887e385c038cf058d545325613e5a1dce76a2940ea27d9cd4ffbdefada53c", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "5882dddd019e5012fe0b70641bf40338ab10f0f9e74121cad913b9e82d60734c", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "1849c414447ab711f4977ea05e1db2c86fa4c42c8c86b3cd64578ba05e3e9371", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "3b653223ebe5083a744e18efb3b1dadb30cd0addf0e14fdd23652f4588bee9eb", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "646651aa0d6f0cc690e63dd06d3bbb9f31e1ae19280829d7ab5b9e249405e468", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "435983d5d72f0fc399a7dbf17e2380625349ab9997441a27c344b099e9e50d39", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "1ed56b3e57c9d476caa87ba43c880436c598b90e60f7d549c7b74b7e8be73116", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "e748c76ae52b0ab7ef47af98d5d2ca5f18ae4876d5f2f61b565711477dd0b0c8", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "46e6abb3791ae40858875bce69e622d382ee7ab2c439d1e4dcc60183d7088575", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "69572342656ed3f3dbf10aeefed38a3794038610da119fea173137e0e22ff864", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "95ac74614c5ba2a42be052afe1ebc07da10d8a7fb31379ce3c3847dd2e8e8751", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "6b2dbd4c4bece475323e0f03dea724bf7e724be01aaafaa77dfc30efadc96a7f", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "fc51b976d66cf295be2012c08f479f3a72168ee06b398277fbabbc021b35fde3", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a96a48de16e97d500e866472e225e72cf3146cc560c88e87ccc3e48476a85754", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "61130cfd29845cb6d7dde8da6060f5e1fae8f4b43b90d697d88bb8cfb86bddee", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "d36b1b8c00db82b27efd89af51adc30c1858de8f09755542ec89c231e5712901", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a9be8d20ea182a8e0b67662890aa6ba905772b0b35ae11a53b0c2a424fcc0282", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "7eecae5b8f6e35a0d9e2fa2d95e241bc445856a15a7eb80fd816809cfc10da42", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "3fb40c5f7c6bed6c994d8d543a004fc0365026ee07bc4982146c2e52b2f70727", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "c412b0c1ae2268324607156afdb13aa64d55e53d4be04d17d2b9ccbc78674a4f", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "4791087a3d58a78b7b8318af4e9bfa4404220d0e8f6c115f601b80b1272a8bee", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "fd557c5cdfad9393fe4fdb3cc313bc2dfc54710e4eab454d0f5e8261611676f6", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "5dc513e363646e6f6c4fea280ae54871661387460acbc4613ef9a9e6f442a392", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "b0a480d05dba6332b7b53605774590773be9df7612dc1f3d3c008c97fdbe1ded", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "861c41b2221011dcc653b412eee45f530b2ac0ff7067a2dc1b2ffc2891cc110c", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "0b9e1d424d6a35eb1e9215e641692e2e33c4fe90aecfdb60c26c953a02c103d5", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "46d2ecea9609573f933b61b1d9522f41bc4cf7e34e5db1b6d83302062639e13d", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "3bf026f6a7681f1ff3dde481b817d60b78f4da8863cd61a2c24a5a04feab4c23", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a9136423ee24a5398480d3b37b13e67f34b21a459bbb18f6578252fd62d56074", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "938fcfc1c5c37db9890ff73104a37326d24fe83de62d74b9ba1df1fc7bee9a27", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "169b2479b3f0ee9c9ba2fe5b4aa576c03472a0d6158a41ee8f81ca7b6f0a03be", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a120adde8d201741e6816cfc2e332438b608dd703bcb9982be616eb2320ee7d1", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "e2d351c28a50f16757f5f3b875bd06feaf19bd22a4f0fe025c125196ada2301f", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "56dce24ebc32c52a6e1e1ab8dd8cfdbb4630a5bada80e2ea470f2f4809b5bfe1", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "29fdf7203d05616b2f48c06866a10f2401b70f6c4e5034ab296be56237b79a53", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "99a16f60a67960a163b50c5a4eda522f8d4c1f6ce3ca685e81e7968045030a2e", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "cde6394f68de028650988fe80763d303a8c921b5d29a4a24f3bc5a52cfab6a79", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a603b940a9d5126dab15ce396dc92a47af6a0fb00819e6882f2c36512ce2542a", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "54284ea939e89d5096f38cff195cf4a716477c1b60e45fcbed72452d8cfd5670", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "6bd7596b6dc238c13eed1eeea97d4617f6009fce23ae8c08e3762711bb64da24", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "f5576a0debe6131de79e6f64fbb3f893be58574f57e1bb0b7c77d8d14e0f96cd", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a92e7fdb0ed7b516adfc0b595df4ef84437f11643178ba3204e772096188d9ec", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "ec3017b65bb2eb18b3927034677986c60f4bc79129a5da9b0fe52a937dfed83f", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "4614b34640d586ef2d457990f54787631c73d73597b0bb070a73ac331891def6", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "36179359c22be82beab63f3d7bad1eee966da00a39546bb21d2b46da180cae70", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "4ab7cdcee81e942a4daf4e7a2f242358400007ac83ab1e0426f80c4008d9c19c", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "d33f869732e71b44ea225c04300b29f44c0894761195acdc11f144a73b9ee5da", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "3fc678db441d1a1d17f6407187682dcc2c2d4f96b9d85ebb01e20e4a8ff09137", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "cf89aa91f2169d8b375e0c8d36f437b6f4ff566129e8552f98726e7f556a6ae7", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "de62e07f16e9a92608eb4d332b7ebf57af9e0ffd217039c9629ff60adc1d5ec7", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "466758d82cb1278bed72624bd4470e0d81157830fb8c9deb53ed588fcbbaedad", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "96d04c46d0f558f46d400ac52e1677ec33dd245acb7c2ab7c2abf4efa271ceca", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "d1bf186efffae0ade72a6b25a28ac49507e4ae3c62b05fa0389d31f6abc555b9", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a9638b29a00a848cbb997d4ec64ae27d55281a7026e8d948eba35d02a7d713aa", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a5510eaa3418b651e2d146ea9118209a6420aa2e6d3ad78360936c3cdd59337d", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "7432330c72a3dcc930c68ff6d17b16bb1c44b1396278e116de1fcdbaf8f6a87a", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "be23599ee30c0733378cfa9285573f99d88f227b8343673acafa36b6d742178f", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "d61b4d049609a8b9194045c0aa9dba46b42b08286e1a67d32b258b94b01e125a", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a9d5f8bb4e5c919b93845e3ed9d0652cbb1f92adc10da6b23b8c5c07d2f77697", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "1dea78b4c2daee757947366b9ac12b1776ad2426289ae7046f5598c17917eb19", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "6ca33eb8f7881ef647c3a23a77599fdf87ca004c360cd011646c61b765d703f4", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "cc7e24f62839009d6a3ed0eaf5d153b3f23b347ea3c61536d93a8c8bf5aca7e5", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "c759c58887a5cbdbaf7b09dd1f9ce9477b6c3ff63cd9df8857b5c028e47184d2", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "e2d99dddf843b59a9917f57145d96e8785cba1df44a5aa4db5505eddeb1add73", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "1eb9f6b1aff258d46b355f8cedebe3ff6212bec832911cc4a37d070150599477", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "3602ad21350146258c737102f5a3a0b43f6f4f0663ec6593c6aa725f35cd0be0", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "2606f6567e7cfaa1b68111f585ebb8dd5c725be3a7043d8d384a732c821da4a7", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "7467fb676141565cde44bffd991482c0e64afbff99b9d1a7c587514c956ff959", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8d4b475eb1e864c1380725e194c4ae12c6ad228ba43acb986275c84003a35f45", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "d6e1c98c7d841df8024ac66eb3e0dcad5575ba2b4b27cc5a02b1ad1562e5edcc", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8bbb36ba5a3f6f8640436485d642112b16562f293f30ad1c565534404b79ad55", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "b5043f10789714d3b8ab9740ba1273d2872506f88c31cded3dcf7e131fe81a20", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "5bb2aa9f2749f0095cf01f4314dec798a8d996b4bfdb349ed4754a39df6ee564", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8b6420145fea13662c0b47ab691f2358039345b9d04fa0508cd0ad6eb1fcade2", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "f0239371bee93a5a936b26c7566c1adbe374a5b4e5c40b7f10e0288391ed35c0", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "1509791121b4f9349a8c7bdd6ccab4431c35d1830fc3c3c368e1a33fb44ac57a", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "4b88ab0325b3e4e6425b74c2b1a39932ea7a1b8c494a588ed93571340bfa5e1b", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "161c4413772e5799aa8925f14264340b6e84882244f7448d67bf98a4b87322b1", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "537b877755daf480be9c85b963939144ae693b361ba694b41d378c11582bf3a2", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "aade5bb0316908635ca7a93605044b1a797a0091a0cd999a3f576b9ff3917444", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "3eafa46fdb667c3250ea3e0f644ecca5957c0f6c7ecab4f026b2101161644d3b", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "902bad6e0422134040e9ce481274100274e5117a84cdf62b578cafadb8e771b4", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "16c1e4e0a15553cf23ca37c5c0a1018ed4a618c09c1e0ca2f06c3fe006785090", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "b9a168027c2e2b6ef3dfec99b1a200a6c4410d9c74befa7728f196222ac69bc4", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "97d9682ecbf3b71f9c189a5482185ee77e8dc1736dac6ea28f3e4b7e62954730", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "ee04ea6480c116740324074211cfe2fa7276b016047b57bb13ab344f3fa5887c", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "ad0c5dedb8c1926a83e8b93d466dbcbb8f2065d065287c2e09a1c09987c9206a", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "4d6baffef8c1bce956d5075ef28e1a5ff24c550df957939ed15a70c699a50bdb", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "1e8969ad0064a2a9a930fb568693ff2c9b2472e9d934e0abe270fba8d374b59a", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8d887ed6a1e8cf8cca1e1a2f8146632869cfac201ddc003c0f3300ee7fbc93db", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "24d863b541470618df4bfb83097360f2efa1be4a5e4216f93e3c6f0be538cd5a", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "c26832d4489a1bd15223e00aef1c1de5c5f717d62cfa25387ffb3a9a4222b369", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "c435655721c4ac6acdb0608821c7b43806f3cb3e9c85416834cc007e151b2b62", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "79b4aa9e9c8eaf74f807195b966d459492fbc92cf44159098b02bca48a65faec", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "74a01bc07d9e6922f1fd44eca58578ae0f4c7d401529de95459879ab8f9784fd", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "7aa519ad0758031ba16c944c889d803de987bdc4177600c84ae17cb961e8f41e", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "64dfff79a9f0a155b1cf1efd06b389d19cf17715b9b3f06b332ae92f442c602d", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "0c482adffe52466ee562ea35906725ea9988a87c2ff401473521768788b99ef4", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "e20dae60d3cece641236dda9c91400422087c2f89918b4f43de98162e4ec6398", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "0c114c4567cd9634e5f7a86e4563e02b0206afbe50446454385d5b7a473d9211", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "55eac3a0a21dbd26dac88b3a3ebc52232cc9605c410baf059243272978e2d813", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "dcb1e134211b899cf6a985cf3a868a42011a9f55bfba4ab008b27243246635b0", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "072ce7ed9732efb2e908d551849dfbcf40c106fb68e18fa26797a40cfb44b7e7", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "5b36748898bde980ff4798f48f14be7c1247a59e8a2949e4804ac1e5b3067d78", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "9819c2406e66950a0666d285a465bb4975d5fc654d8041dd8e0bade38c6e7a91", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "83941d512813c35caa9e328af4275567a4aad6699b10c94114552206c28b7517", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "43ae36242bec2bd884f4a1b249876d7dc6f62b2e4a712dbd34f826acf63f94fd", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "d6c55242a86b115ab71af9f5be4bf713cf60ebf1118d02483dd7765e78f0a97c", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "8a67585fdb47506fefefd5b064adac84e76e1d698431fc06bc04d38473214328", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "afb54928f71ac92b8bd43a7a8fa4702aefed22df1c303e8ca31ef92e8b8f37b0", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "bf7f032091c25cab21a23df810ade9434c2f8dc92101f09e60dfccbec40f93e6", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "93d5a0273f2652ac492aea28779a6d76025986c0ef40eb1bbc96d74cca147b27", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "6f380ba8d6230a65a375674d5ebc2e2ad30cfdd2dde23788c3fed854447aa357", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "47ed2ed651f3adf45f519130df641fbc2e8f5129d3b0032b6ca071ceb28e59a6", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "cd2ff890723d0b5dfe18556c1d16035a8035e156f2651ce93c5c218ae6de27eb", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 3, "severity": "low", "title": "Google Cloud Storage reference", "redacted_display": "https://███████.googleapis.com/███", "fingerprint": "a0fc403f990b2852d7492454e23b9bd37f61c94d64992e40408c4c0341263083", "verified": false, "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, { "finding_type": 6, "severity": "low", "title": "Private key material (third-party library artifact, shared across 38 unrelated developers)", "redacted_display": "-----BEGIN PRIVATE KEY----- (redacted)", "fingerprint": "3189648d5bf63b56f1e623ad34abfd31b5aafb8386cd0e339f686035f6b89661", "verified": false, "cwe": [ "CWE-321" ], "masvs": [ "MASVS-CRYPTO-2" ], "remediation": "Never ship private-key material in a client. Revoke/rotate the compromised key and hold it server-side or in a hardware-backed store." }, { "finding_type": 6, "severity": "low", "title": "Private key material (third-party library artifact, shared across 35 unrelated developers)", "redacted_display": "-----BEGIN PRIVATE KEY----- (redacted)", "fingerprint": "c1a462d35e9d998542f260b9f5a31118a3bd6ff10f693669e49e3ed5ab96b879", "verified": false, "cwe": [ "CWE-321" ], "masvs": [ "MASVS-CRYPTO-2" ], "remediation": "Never ship private-key material in a client. Revoke/rotate the compromised key and hold it server-side or in a hardware-backed store." }, { "finding_type": 6, "severity": "low", "title": "Private key material (third-party library artifact, shared across 35 unrelated developers)", "redacted_display": "-----BEGIN PRIVATE KEY----- (redacted)", "fingerprint": "bf16f96c797ac5c41b335521fd3988134b858c59b7e729bc85ffb51435e0567a", "verified": false, "cwe": [ "CWE-321" ], "masvs": [ "MASVS-CRYPTO-2" ], "remediation": "Never ship private-key material in a client. Revoke/rotate the compromised key and hold it server-side or in a hardware-backed store." }, { "finding_type": 6, "severity": "low", "title": "Private key material (third-party library artifact, shared across 35 unrelated developers)", "redacted_display": "-----BEGIN PRIVATE KEY----- (redacted)", "fingerprint": "f2a88cfd724792cb46afa0446f6159bc9e1d9a0f797bd2ed033792a0d2126c50", "verified": false, "cwe": [ "CWE-321" ], "masvs": [ "MASVS-CRYPTO-2" ], "remediation": "Never ship private-key material in a client. Revoke/rotate the compromised key and hold it server-side or in a hardware-backed store." }, { "finding_type": 20, "severity": "low", "title": "Google API key (client-shipped; restriction unverified)", "redacted_display": "AIza•••••••• (21–40 chars, redacted)", "fingerprint": "1cc4714c14104533d39c00b34568289323a0d1fbc4574152929081630970424d", "verified": false, "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ], "remediation": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, { "finding_type": 20, "severity": "low", "title": "Google API key (client-shipped; restriction unverified)", "redacted_display": "AIza•••••••• (21–40 chars, redacted)", "fingerprint": "f236fc3b794cc18d1610eb5c763762aea94da2d9b50af8a2c351a628307b65c8", "verified": false, "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ], "remediation": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, { "finding_type": 60, "severity": "low", "title": "Background location access with advertising SDKs present", "redacted_display": "background location + ad SDKs", "fingerprint": "0c010d775be9542eee48043eb496c06888f9b8e8fcdf3af66a6b84e99192f6ce", "verified": false, "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-1" ], "remediation": "Justify background location; request foreground-only where possible and disclose the use in the Play Data Safety form." }, { "finding_type": 72, "severity": "low", "title": "Sentry DSN", "redacted_display": "https://███████.ingest.us.sentry.io/███", "fingerprint": "09ae552e240bc97f98d4471a6c4edf06da6ef08895c7ec8e4737f139a9a66b1f", "verified": false, "cwe": [ "CWE-200" ], "masvs": [ "MASVS-STORAGE-2" ], "remediation": "A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events." }, { "finding_type": 77, "severity": "low", "title": "Data Safety label omits Location", "redacted_display": "app can access location (Approximate location); not in the declaration", "fingerprint": "cacfd47daa7d0aafb7cbd1791f3964ef2850687203797b5e24429c41acdf7290", "verified": false, "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-3" ], "remediation": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, { "finding_type": 77, "severity": "low", "title": "Data Safety label omits Contacts", "redacted_display": "app can access contacts (Contacts); not in the declaration", "fingerprint": "52d6df5eafe80ad7de0275ee425de0bf8d715439e92a9026117bea4d546827d0", "verified": false, "cwe": [ "CWE-359" ], "masvs": [ "MASVS-PRIVACY-3" ], "remediation": "Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected." }, { "finding_type": 34, "severity": "medium", "title": "Cleartext (HTTP) traffic permitted", "redacted_display": "android:usesCleartextTraffic=\"true\"", "fingerprint": "94025ca91177232efea2d52d976e37f967866402c6e01f481a8de610b8e478e7", "verified": false, "cwe": [ "CWE-319" ], "masvs": [ "MASVS-NETWORK-1" ], "remediation": "Set android:usesCleartextTraffic=false and/or a networkSecurityConfig that forbids cleartext; serve all endpoints over HTTPS." } ], "live_verification": { "verified_count": 0, "items": [] }, "trackers_count": 6, "pii": { "sources": 9, "identifiers": [ "Advertising ID (AAID)", "Android ID", "Device ID / IMEI" ], "destinations": 4 }, "sbom": { "component_count": 111, "vuln_count": 0, "components": [ { "name": "androidx.activity:activity", "version": "1.9.0", "cves": [] }, { "name": "androidx.activity:activity-compose", "version": "1.9.0", "cves": [] }, { "name": "androidx.activity:activity-ktx", "version": "1.9.0", "cves": [] }, { "name": "androidx.annotation:annotation-experimental", "version": "1.4.1", "cves": [] }, { "name": "androidx.appcompat:appcompat", "version": "1.7.0", "cves": [] }, { "name": "androidx.appcompat:appcompat-resources", "version": "1.7.0", "cves": [] }, { "name": "androidx.asynclayoutinflater:asynclayoutinflater", "version": "1.0.0", "cves": [] }, { "name": "androidx.autofill:autofill", "version": "1.1.0", "cves": [] }, { "name": "androidx.biometric:biometric", "version": "1.1.0", "cves": [] }, { "name": "androidx.browser:browser", "version": "1.8.0", "cves": [] }, { "name": "androidx.camera.featurecombinationquery:featurecombinationquery", "version": "1.5.0", "cves": [] }, { "name": "androidx.camera:camera-camera2", "version": "1.5.0", "cves": [] }, { "name": "androidx.camera:camera-core", "version": "1.5.0", "cves": [] }, { "name": "androidx.camera:camera-extensions", "version": "1.5.0", "cves": [] }, { "name": "androidx.camera:camera-lifecycle", "version": "1.5.0", "cves": [] }, { "name": "androidx.camera:camera-video", "version": "1.5.0", "cves": [] }, { "name": "androidx.camera:camera-view", "version": "1.5.0", "cves": [] }, { "name": "androidx.cardview:cardview", "version": "1.0.0", "cves": [] }, { "name": "androidx.compose.animation:animation", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.animation:animation-core", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.foundation:foundation", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.foundation:foundation-layout", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.material3:material3", "version": "1.3.1", "cves": [] }, { "name": "androidx.compose.material:material-icons-core", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.material:material-ripple", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.runtime:runtime", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.runtime:runtime-saveable", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.ui:ui", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.ui:ui-geometry", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.ui:ui-graphics", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.ui:ui-text", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.ui:ui-unit", "version": "1.7.6", "cves": [] }, { "name": "androidx.compose.ui:ui-util", "version": "1.7.6", "cves": [] }, { "name": "androidx.coordinatorlayout:coordinatorlayout", "version": "1.2.0", "cves": [] }, { "name": "androidx.core:core", "version": "1.15.0", "cves": [] }, { "name": "androidx.core:core-ktx", "version": "1.15.0", "cves": [] }, { "name": "androidx.credentials:credentials", "version": "1.5.0", "cves": [] }, { "name": "androidx.credentials:credentials-play-services-auth", "version": "1.5.0", "cves": [] }, { "name": "androidx.cursoradapter:cursoradapter", "version": "1.0.0", "cves": [] }, { "name": "androidx.customview:customview", "version": "1.1.0", "cves": [] }, { "name": "androidx.customview:customview-poolingcontainer", "version": "1.0.0", "cves": [] }, { "name": "androidx.databinding:viewbinding", "version": "8.13.0", "cves": [] }, { "name": "androidx.datastore:datastore", "version": "1.1.7", "cves": [] }, { "name": "androidx.datastore:datastore-core", "version": "1.1.7", "cves": [] }, { "name": "androidx.datastore:datastore-preferences", "version": "1.1.7", "cves": [] }, { "name": "androidx.datastore:datastore-preferences-core", "version": "1.1.7", "cves": [] }, { "name": "androidx.documentfile:documentfile", "version": "1.0.0", "cves": [] }, { "name": "androidx.drawerlayout:drawerlayout", "version": "1.1.1", "cves": [] }, { "name": "androidx.dynamicanimation:dynamicanimation", "version": "1.0.0", "cves": [] }, { "name": "androidx.emoji2:emoji2", "version": "1.3.0", "cves": [] }, { "name": "androidx.emoji2:emoji2-views-helper", "version": "1.3.0", "cves": [] }, { "name": "androidx.exifinterface:exifinterface", "version": "1.3.6", "cves": [] }, { "name": "androidx.fragment:fragment", "version": "1.8.6", "cves": [] }, { "name": "androidx.fragment:fragment-ktx", "version": "1.8.6", "cves": [] }, { "name": "androidx.graphics:graphics-path", "version": "1.0.1", "cves": [] }, { "name": "androidx.interpolator:interpolator", "version": "1.0.0", "cves": [] }, { "name": "androidx.legacy:legacy-support-core-ui", "version": "1.0.0", "cves": [] }, { "name": "androidx.legacy:legacy-support-core-utils", "version": "1.0.0", "cves": [] }, { "name": "androidx.legacy:legacy-support-v4", "version": "1.0.0", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-extensions", "version": "2.2.0", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-livedata", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-livedata-core", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-livedata-core-ktx", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-livedata-ktx", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-process", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-runtime", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-runtime-compose", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-runtime-ktx", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-service", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-viewmodel", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-viewmodel-ktx", "version": "2.8.7", "cves": [] }, { "name": "androidx.lifecycle:lifecycle-viewmodel-savedstate", "version": "2.8.7", "cves": [] }, { "name": "androidx.loader:loader", "version": "1.1.0", "cves": [] }, { "name": "androidx.localbroadcastmanager:localbroadcastmanager", "version": "1.1.0", "cves": [] }, { "name": "androidx.media2:media2-common", "version": "1.2.1", "cves": [] }, { "name": "androidx.media2:media2-session", "version": "1.2.1", "cves": [] }, { "name": "androidx.media:media", "version": "1.6.0", "cves": [] }, { "name": "androidx.print:print", "version": "1.0.0", "cves": [] }, { "name": "androidx.privacysandbox.ads:ads-adservices", "version": "1.1.0-beta11", "cves": [] }, { "name": "androidx.privacysandbox.ads:ads-adservices-java", "version": "1.1.0-beta11", "cves": [] }, { "name": "androidx.profileinstaller:profileinstaller", "version": "1.3.1", "cves": [] }, { "name": "androidx.recyclerview:recyclerview", "version": "1.1.0", "cves": [] }, { "name": "androidx.room:room-ktx", "version": "2.6.1", "cves": [] }, { "name": "androidx.room:room-runtime", "version": "2.6.1", "cves": [] }, { "name": "androidx.savedstate:savedstate", "version": "1.2.1", "cves": [] }, { "name": "androidx.savedstate:savedstate-ktx", "version": "1.2.1", "cves": [] }, { "name": "androidx.security:security-crypto", "version": "1.1.0-alpha06", "cves": [] }, { "name": "androidx.slidingpanelayout:slidingpanelayout", "version": "1.0.0", "cves": [] }, { "name": "androidx.sqlite:sqlite", "version": "2.4.0", "cves": [] }, { "name": "androidx.sqlite:sqlite-framework", "version": "2.4.0", "cves": [] }, { "name": "androidx.startup:startup-runtime", "version": "1.1.1", "cves": [] }, { "name": "androidx.swiperefreshlayout:swiperefreshlayout", "version": "1.1.0", "cves": [] }, { "name": "androidx.tracing:tracing", "version": "1.2.0", "cves": [] }, { "name": "androidx.tracing:tracing-ktx", "version": "1.2.0", "cves": [] }, { "name": "androidx.transition:transition", "version": "1.5.0", "cves": [] }, { "name": "androidx.vectordrawable:vectordrawable", "version": "1.1.0", "cves": [] }, { "name": "androidx.vectordrawable:vectordrawable-animated", "version": "1.1.0", "cves": [] }, { "name": "androidx.versionedparcelable:versionedparcelable", "version": "1.1.1", "cves": [] }, { "name": "androidx.viewpager2:viewpager2", "version": "1.0.0", "cves": [] }, { "name": "androidx.viewpager:viewpager", "version": "1.0.0", "cves": [] }, { "name": "androidx.webkit:webkit", "version": "1.12.1", "cves": [] }, { "name": "androidx.window.extensions.core:core", "version": "1.0.0", "cves": [] }, { "name": "androidx.window:window", "version": "1.2.0", "cves": [] }, { "name": "androidx.window:window-java", "version": "1.2.0", "cves": [] }, { "name": "androidx.work:work-runtime", "version": "2.9.0", "cves": [] }, { "name": "androidx.work:work-runtime-ktx", "version": "2.9.0", "cves": [] }, { "name": "com.google.android.material:material", "version": "1.12.0", "cves": [] }, { "name": "com.squareup.okhttp3:okhttp", "version": "4.9.2", "cves": [] }, { "name": "kotlinx:coroutines_android", "version": "1.9.0", "cves": [] }, { "name": "kotlinx:coroutines_core", "version": "1.9.0", "cves": [] }, { "name": "kotlinx:coroutines_play_services", "version": "1.9.0", "cves": [] } ] }, "control_coverage": { "schema": "apk-scanner.coverage/v1", "framework": "OWASP MASVS v2", "disclaimer": "Static, metadata-only analysis. Each control is scored evidence-for / gap-signal / requires-manual-testing. This is evidence toward a MASVS assessment, NOT a certification — apk-scanner.com is not an authorized assessment lab. Absence of a static finding does not prove a control passes.", "rows": [ { "control": "MASVS-STORAGE-1", "category": "STORAGE", "title": "The app securely stores sensitive data.", "static": "partial", "status": "gap-detected", "count": 2, "findings": [ { "finding_type": 20, "key": "google_api_key", "title": "Google API key (client-shipped; restriction unverified)", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 798 ] }, { "finding_type": 20, "key": "google_api_key", "title": "Google API key (client-shipped; restriction unverified)", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 798 ] } ] }, { "control": "MASVS-STORAGE-2", "category": "STORAGE", "title": "The app prevents leakage of sensitive data.", "static": "partial", "status": "gap-detected", "count": 123, "findings": [ { "finding_type": 2, "key": "firebase_rtdb", "title": "Firebase Realtime Database reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 3, "key": "gcs_bucket", "title": "Google Cloud Storage reference", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 200, 284 ] }, { "finding_type": 72, "key": "sentry_dsn", "title": "Sentry DSN", "severity": "low", "verified": false, "relationship": "informational", "cwe": [ 200 ] } ] }, { "control": "MASVS-CRYPTO-1", "category": "CRYPTO", "title": "The app employs current strong cryptography and uses it according to best practices.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-CRYPTO-2", "category": "CRYPTO", "title": "The app performs key management according to best practices.", "static": "partial", "status": "gap-detected", "count": 4, "findings": [ { "finding_type": 6, "key": "private_key", "title": "Private key material (third-party library artifact, shared across 38 unrelated developers)", "severity": "low", "verified": false, "relationship": "gap-confirmed", "cwe": [ 321 ] }, { "finding_type": 6, "key": "private_key", "title": "Private key material (third-party library artifact, shared across 35 unrelated developers)", "severity": "low", "verified": false, "relationship": "gap-confirmed", "cwe": [ 321 ] }, { "finding_type": 6, "key": "private_key", "title": "Private key material (third-party library artifact, shared across 35 unrelated developers)", "severity": "low", "verified": false, "relationship": "gap-confirmed", "cwe": [ 321 ] }, { "finding_type": 6, "key": "private_key", "title": "Private key material (third-party library artifact, shared across 35 unrelated developers)", "severity": "low", "verified": false, "relationship": "gap-confirmed", "cwe": [ 321 ] } ] }, { "control": "MASVS-AUTH-1", "category": "AUTH", "title": "The app uses secure authentication and authorization protocols.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-AUTH-2", "category": "AUTH", "title": "The app performs local authentication securely.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-AUTH-3", "category": "AUTH", "title": "The app secures sensitive operations with additional authentication.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-NETWORK-1", "category": "NETWORK", "title": "The app secures all network traffic according to current best practices.", "static": "yes", "status": "gap-detected", "count": 1, "findings": [ { "finding_type": 34, "key": "cleartext_traffic", "title": "Cleartext (HTTP) traffic permitted", "severity": "medium", "verified": false, "relationship": "gap-confirmed", "cwe": [ 319 ] } ] }, { "control": "MASVS-NETWORK-2", "category": "NETWORK", "title": "The app verifies the identity of the remote endpoint (e.g. certificate pinning).", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PLATFORM-1", "category": "PLATFORM", "title": "The app uses IPC mechanisms securely.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PLATFORM-2", "category": "PLATFORM", "title": "The app uses WebViews securely.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PLATFORM-3", "category": "PLATFORM", "title": "The app uses the user interface securely.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-CODE-1", "category": "CODE", "title": "The app requires an up-to-date platform version.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-CODE-2", "category": "CODE", "title": "The app has a mechanism for enforcing updates.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-CODE-3", "category": "CODE", "title": "The app only uses software components without known vulnerabilities.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-CODE-4", "category": "CODE", "title": "The app validates and sanitizes all untrusted inputs and follows secure-coding practice.", "static": "partial", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-1", "category": "RESILIENCE", "title": "The app validates the integrity of the platform.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-2", "category": "RESILIENCE", "title": "The app implements anti-tampering mechanisms.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-3", "category": "RESILIENCE", "title": "The app implements anti-static-analysis mechanisms.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-RESILIENCE-4", "category": "RESILIENCE", "title": "The app implements anti-dynamic-analysis techniques.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-1", "category": "PRIVACY", "title": "The app minimizes access to sensitive data and resources.", "static": "yes", "status": "gap-detected", "count": 1, "findings": [ { "finding_type": 60, "key": "bg_location", "title": "Background location access with advertising SDKs present", "severity": "low", "verified": false, "relationship": "gap-confirmed", "cwe": [ 359 ] } ] }, { "control": "MASVS-PRIVACY-2", "category": "PRIVACY", "title": "The app prevents identification of the user.", "static": "yes", "status": "no-static-findings", "count": 0, "findings": [] }, { "control": "MASVS-PRIVACY-3", "category": "PRIVACY", "title": "The app is transparent about data collection and usage.", "static": "yes", "status": "gap-detected", "count": 2, "findings": [ { "finding_type": 77, "key": "ds_underdeclare", "title": "Data Safety label omits Location", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 359 ] }, { "finding_type": 77, "key": "ds_underdeclare", "title": "Data Safety label omits Contacts", "severity": "low", "verified": false, "relationship": "gap-signal", "cwe": [ 359 ] } ] }, { "control": "MASVS-PRIVACY-4", "category": "PRIVACY", "title": "The app offers user control over their data.", "static": "manual", "status": "requires-manual-testing", "count": 0, "findings": [] } ], "categories": [ { "category": "STORAGE", "controls": 2, "gaps": 2, "verified": 0, "manual": 0 }, { "category": "CRYPTO", "controls": 2, "gaps": 1, "verified": 0, "manual": 0 }, { "category": "AUTH", "controls": 3, "gaps": 0, "verified": 0, "manual": 3 }, { "category": "NETWORK", "controls": 2, "gaps": 1, "verified": 0, "manual": 0 }, { "category": "PLATFORM", "controls": 3, "gaps": 0, "verified": 0, "manual": 1 }, { "category": "CODE", "controls": 4, "gaps": 0, "verified": 0, "manual": 1 }, { "category": "RESILIENCE", "controls": 4, "gaps": 0, "verified": 0, "manual": 4 }, { "category": "PRIVACY", "controls": 4, "gaps": 2, "verified": 0, "manual": 1 } ] } }, "proof": { "alg": "ed25519", "key_id": "IE6LeZNX4dAAPLGr", "digest_sha256": "8734c08d0ae171f5e88adc6b412b8de5718d00290d82f6f1e69f628fe8ccc871", "signature": "1oPaQjefcRGZ8lAn8CG287w8yX5NgbwmIkU+ImFtRpuGPLe85vbDfwDLZiAKa+1fl9661uf9seTzFXNrtH+wBQ==", "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAwH2fYdYB5nD0CQslDtG3FgafcJBoOX2OGoT80Woksrk=\n-----END PUBLIC KEY-----\n", "verify_url": "https://apk-scanner.com/verify" } }