apk-scanner.com
AIO Launcher
ru.execbit.aiolauncher · Build 7.6.0
Analysis: complete. Static analysis completed for this build. A grade is not a guarantee of safety. Historical verification does not establish current reachability.
- Grade / score
- B · 79/100
- Finding categories
- 4
- Occurrences
- 7
- Scanned
- 2026-09-30T05:56:32.649Z
- Document issued
- 2026-10-14T14:25:05.650Z
- Historical verifications
- 0
Finding evidence
Open a category to review its occurrences. Printing includes all categories and occurrences.
Google OAuth client secret · high · 1 occurrence
Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.
CWE-798 · MASVS-STORAGE-1
•••••••• (21–40 chars, redacted)
Private key material (third-party library artifact, shared across 185 unrelated developers) · low · 2 occurrences
Never ship private-key material in a client. Revoke/rotate the compromised key and hold it server-side or in a hardware-backed store.
CWE-321 · MASVS-CRYPTO-2
-----BEGIN PRIVATE KEY----- (redacted)-----BEGIN PRIVATE KEY----- (redacted)
Sentry DSN · low · 1 occurrence
A client DSN is low-risk but confirm it is a client (not internal) DSN and cannot be abused to spoof events.
CWE-200 · MASVS-STORAGE-2
https://█████████████████.ingest.us.sentry.io/███
Data Safety label omits Contacts · low · 3 occurrences
Update the Play Data Safety form to declare the observed data category, or remove the capability if the data is not actually collected.
CWE-359 · MASVS-PRIVACY-3
app can access contacts (Contacts); not in the declarationapp can access location (Approximate location); not in the declarationapp can access calendar (Calendar); not in the declaration
Control coverage
Mapped static evidence does not establish a control pass. Manual assessment remains separate.
| Control | Requirement | Recorded status |
|---|---|---|
| MASVS-STORAGE-1 | The app securely stores sensitive data. | Review signal |
| MASVS-STORAGE-2 | The app prevents leakage of sensitive data. | Review signal |
| MASVS-CRYPTO-1 | The app employs current strong cryptography and uses it according to best practices. | No static findings · not a pass |
| MASVS-CRYPTO-2 | The app performs key management according to best practices. | Review signal |
| MASVS-AUTH-1 | The app uses secure authentication and authorization protocols. | Manual assessment |
| MASVS-AUTH-2 | The app performs local authentication securely. | Manual assessment |
| MASVS-AUTH-3 | The app secures sensitive operations with additional authentication. | Manual assessment |
| MASVS-NETWORK-1 | The app secures all network traffic according to current best practices. | No static findings · not a pass |
| MASVS-NETWORK-2 | The app verifies the identity of the remote endpoint (e.g. certificate pinning). | No static findings · not a pass |
| MASVS-PLATFORM-1 | The app uses IPC mechanisms securely. | No static findings · not a pass |
| MASVS-PLATFORM-2 | The app uses WebViews securely. | No static findings · not a pass |
| MASVS-PLATFORM-3 | The app uses the user interface securely. | Manual assessment |
| MASVS-CODE-1 | The app requires an up-to-date platform version. | No static findings · not a pass |
| MASVS-CODE-2 | The app has a mechanism for enforcing updates. | Manual assessment |
| MASVS-CODE-3 | The app only uses software components without known vulnerabilities. | No static findings · not a pass |
| MASVS-CODE-4 | The app validates and sanitizes all untrusted inputs and follows secure-coding practice. | No static findings · not a pass |
| MASVS-RESILIENCE-1 | The app validates the integrity of the platform. | Manual assessment |
| MASVS-RESILIENCE-2 | The app implements anti-tampering mechanisms. | Manual assessment |
| MASVS-RESILIENCE-3 | The app implements anti-static-analysis mechanisms. | Manual assessment |
| MASVS-RESILIENCE-4 | The app implements anti-dynamic-analysis techniques. | Manual assessment |
| MASVS-PRIVACY-1 | The app minimizes access to sensitive data and resources. | No static findings · not a pass |
| MASVS-PRIVACY-2 | The app prevents identification of the user. | No static findings · not a pass |
| MASVS-PRIVACY-3 | The app is transparent about data collection and usage. | Review signal |
| MASVS-PRIVACY-4 | The app offers user control over their data. | Manual assessment |
Build identity and signature
- Scan ID
- b132c5ad-c47d-404e-b3b9-b4b224dd8ade
- APK SHA-256
4aa8342c0453132b6a152b8d6c8bfa80290c382d412d025e3806ca92b37f2c66- Capsule SHA-256
17fc03747531abe0ab12f17d8f0181a23ee25b1e2137d872c34a8d497f789987- Signing key
- IE6LeZNX4dAAPLGr
Verify the signed JSON at apk-scanner.com/verify. This printed view is a presentation of the signed record; the JSON is the verification artifact.