{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "apk-scanner.com", "informationUri": "https://apk-scanner.com", "version": "1.0.0", "rules": [ { "id": "APKSCAN-37-allow_backup", "name": "AllowBackup", "shortDescription": { "text": "android:allowBackup=\"true\"" }, "fullDescription": { "text": "Backup is on by default on Android; this manifest states it explicitly. If the app stores sensitive local data, define dataExtractionRules/fullBackupContent to exclude it, or set android:allowBackup=false." }, "helpUri": "https://apk-scanner.com/finding/allow_backup", "help": { "text": "Backup is on by default on Android; this manifest states it explicitly. If the app stores sensitive local data, define dataExtractionRules/fullBackupContent to exclude it, or set android:allowBackup=false." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-530", "CWE-312", "MASVS-STORAGE-1", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-530", "CWE-312" ], "masvs": [ "MASVS-STORAGE-1", "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-20-google_api_key", "name": "GoogleApiKey", "shortDescription": { "text": "Google API key (client-shipped; restriction unverified)" }, "fullDescription": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "helpUri": "https://apk-scanner.com/finding/google_api_key", "help": { "text": "Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-35-exported_provider", "name": "ExportedProvider", "shortDescription": { "text": "Exported ContentProvider without permission" }, "fullDescription": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "helpUri": "https://apk-scanner.com/finding/exported_provider", "help": { "text": "Set android:exported=false, or require a signature-level android:permission, and scope grantUriPermissions narrowly." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-926", "CWE-284", "MASVS-PLATFORM-1" ], "security-severity": "2.0", "cwe": [ "CWE-926", "CWE-284" ], "masvs": [ "MASVS-PLATFORM-1" ] } }, { "id": "APKSCAN-53-firebase_storage", "name": "FirebaseStorage", "shortDescription": { "text": "Firebase Storage bucket reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/firebase_storage", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-80-supabase_url", "name": "SupabaseUrl", "shortDescription": { "text": "Supabase project reference" }, "fullDescription": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "helpUri": "https://apk-scanner.com/finding/supabase_url", "help": { "text": "Confirm the bucket/database denies anonymous read (enable auth / storage rules / RLS), then audit its contents for data already exposed while it was open." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-200", "CWE-284", "MASVS-STORAGE-2" ], "security-severity": "2.0", "cwe": [ "CWE-200", "CWE-284" ], "masvs": [ "MASVS-STORAGE-2" ] } }, { "id": "APKSCAN-85-supabase_anon_key", "name": "SupabaseAnonKey", "shortDescription": { "text": "Supabase anon key" }, "fullDescription": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "helpUri": "https://apk-scanner.com/finding/supabase_anon_key", "help": { "text": "Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication." }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "CWE-798", "MASVS-STORAGE-1" ], "security-severity": "2.0", "cwe": [ "CWE-798" ], "masvs": [ "MASVS-STORAGE-1" ] } }, { "id": "APKSCAN-34-cleartext_traffic", "name": "CleartextTraffic", "shortDescription": { "text": "Cleartext (HTTP) traffic permitted" }, "fullDescription": { "text": "Set android:usesCleartextTraffic=false and/or a networkSecurityConfig that forbids cleartext; serve all endpoints over HTTPS." }, "helpUri": "https://apk-scanner.com/finding/cleartext_traffic", "help": { "text": "Set android:usesCleartextTraffic=false and/or a networkSecurityConfig that forbids cleartext; serve all endpoints over HTTPS." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "CWE-319", "MASVS-NETWORK-1" ], "security-severity": "5.0", "cwe": [ "CWE-319" ], "masvs": [ "MASVS-NETWORK-1" ] } } ] } }, "automationDetails": { "id": "apk-scanner/world.photo.social/5768c167-d049-41cd-87f4-b7b1c944ca8d" }, "invocations": [ { "executionSuccessful": true } ], "results": [ { "ruleId": "APKSCAN-37-allow_backup", "level": "note", "message": { "text": "Application data is backup-enabled" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml" } } } ], "partialFingerprints": { "apkscanFingerprint": "68d134f0bcd98a9559d6dd5275f80a3928e4a6490ac4a0f1bd16f87683bd49f8" }, "properties": { "severity": "info", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-20-google_api_key", "level": "note", "message": { "text": "Google API key (client-shipped; restriction unverified)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "ae0043e19ad2f810458c6a9954a28344ae1e3faef993492caa42293091fef949" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-35-exported_provider", "level": "note", "message": { "text": "Exported content provider without permission (third-party library artifact, shared across 401 unrelated developers)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml:com.facebook.FacebookContentProvider" } } } ], "partialFingerprints": { "apkscanFingerprint": "b369abc903581edba05e9ec1a5fc46d6b3e7ae316db05c5f7a90becac10e388b" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-53-firebase_storage", "level": "note", "message": { "text": "Firebase Storage bucket reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "resources.arsc" } } } ], "partialFingerprints": { "apkscanFingerprint": "85e962560eec0b26058393ddf9d137f15e47e3b0325abc9f3c126c8c83a51666" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-80-supabase_url", "level": "note", "message": { "text": "Supabase project reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libapp.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "5b76ec1d74d7262f0e09b3ab50618731a20e2fba54434ed535bc0f0d04213bc5" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-80-supabase_url", "level": "note", "message": { "text": "Supabase project reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libapp.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "997ebb35a0f7f8431d9e261c9f0f7ea659c404be511c0f4a6dc552200582267f" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-80-supabase_url", "level": "note", "message": { "text": "Supabase project reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libapp.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "ec1e0439c178b2004d66d42733975db1eb55c36d01c48c612ca98827b39bb093" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-80-supabase_url", "level": "note", "message": { "text": "Supabase project reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libapp.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "cad91b1574b463ae4d99028814a34e58432badf3d5a99e64c15e8da6ef6e9060" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-80-supabase_url", "level": "note", "message": { "text": "Supabase project reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libapp.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "7f77d2aa1f7ebcecfa627ba79feda98dc4001a7bd6499f3df5b0c8a7301e6482" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-80-supabase_url", "level": "note", "message": { "text": "Supabase project reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libapp.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "9b9a9d5158ef403b3fabe653af084d1e88ea2bc8cb5e4beb0d645c8372c1aaa5" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-80-supabase_url", "level": "note", "message": { "text": "Supabase project reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libapp.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "608e6aca514917f9d8a9f66dad255c180258f3b02a2535a6e3a1b1004efa55e3" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-80-supabase_url", "level": "note", "message": { "text": "Supabase project reference" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libapp.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "124c0e0cb9a855c4393a6bf819aafa4c7fcafe48cfd8e7560ad84fb0e57622fa" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-signal" } }, { "ruleId": "APKSCAN-85-supabase_anon_key", "level": "note", "message": { "text": "Supabase anon key (public client key)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "_split_config.arm64_v8a/lib/arm64-v8a/libapp.so" } } } ], "partialFingerprints": { "apkscanFingerprint": "01e9a39c9e5986c49e24dc14699d8ec051c062564bd17327666a8f071d1b033a" }, "properties": { "severity": "low", "verified": false, "relationship": "gap-confirmed" } }, { "ruleId": "APKSCAN-34-cleartext_traffic", "level": "warning", "message": { "text": "Cleartext (HTTP) traffic permitted" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "AndroidManifest.xml" } } } ], "partialFingerprints": { "apkscanFingerprint": "94025ca91177232efea2d52d976e37f967866402c6e01f481a8de610b8e478e7" }, "properties": { "severity": "medium", "verified": false, "relationship": "gap-confirmed" } } ], "properties": { "analysis": { "issues": [], "stages": { "pii": "complete", "sbom": "complete", "signing": "certificate_parsed", "strings": "complete", "manifest": "complete" }, "status": "complete", "grading": { "policy": "static-coverage-v1", "blockers": [], "eligible": true }, "timings_ms": { "total": 18466.44, "harvest": 8618.688999999997, "detectors": 8615.789000000017 }, "bytes_total": 169763525, "bytes_scanned": 169763525, "bytes_skipped": 0, "files_processed": 1722, "coverage_version": 2, "string_encodings": [ "ascii", "utf16le" ], "signature_validation": "not_performed" }, "provenance": { "mode": "static", "artifacts": [ { "name": "base.apk", "sha256": "cdfff651c3d0cb66f3d9842dd9bbed5c1bd2fef0637bc08e386d9227762a13ac" }, { "name": "config.arm64_v8a.apk", "sha256": "77506839b343c15ffb80710a31dc4e1d06ecf348f20b6d4ab1e4731c771cd5b5" }, { "name": "config.en.apk", "sha256": "4692458ee54d76e2f4479273056fcf71028d3ebe7b4c442f06392c73a564bc27" }, { "name": "config.es.apk", "sha256": "dc1c0a01c1effb8b2290c243c196134c3ace3b9fa8d25ab4c7281cad3029feb3" }, { "name": "config.xxhdpi.apk", "sha256": "a6e580fc8e5f4018bc9381ff09c2ce4f939ff09db9b513bc40278df4938120c3" } ], "ruleset_sha256": "f845a46700295ef0c808b2accb30ba973aca62f3b52fef51e8489d1916061a63" }, "apk_sha256": "cdfff651c3d0cb66f3d9842dd9bbed5c1bd2fef0637bc08e386d9227762a13ac", "app_id": "world.photo.social", "app_title": "TrueVine Christian Dating Meet", "app_version": "4.31.0", "scan_id": "5768c167-d049-41cd-87f4-b7b1c944ca8d", "scanned_at": "2026-10-13T13:56:03.969Z" } } ] }