Use scan evidence in a broader assessment

Organize technical findings for a reviewer, with clear boundaries around what an APK scan can establish.

Android static analysis provides evidence for review. It does not certify compliance, prove runtime data collection, or establish current backend access.

Choose a review area

Mobile security · OWASP MASVS

Review mapped controls

From the scan
Finding categories, recorded manifest settings, and the report’s MASVS coverage view.
Needs your review
Controls marked for manual assessment, runtime behavior, and the completeness of your test scope. A mapped finding is not a control pass.

Browse mapped controls · OWASP MASVS reference

Privacy declarations · Google Play Data safety

Investigate SDKs and references

From the scan
Recognizable tracking SDKs and service references that help identify questions for the app team.
Needs your review
Actual collection and sharing, SDK configuration, consent flows, and server-side processing. A bundled SDK alone does not establish how it is used.

Google makes developers responsible for complete and accurate declarations, including when they use third-party tools. Google Play Data safety guidance.

Children’s privacy · COPPA review

Prepare questions for a privacy review

From the scan
A dated inventory of recognizable SDKs, references, and relevant manifest findings.
Needs your review
Audience, collection practices, consent, retention, and other facts beyond the APK. A static match does not determine a COPPA violation.

Review guidance for children’s apps · FTC COPPA guidance

Prepare an evidence package

  1. Identify the build

    Record the app version, scan date, and available build identifiers. Include analysis coverage and limitations.

  2. Record your review

    Link findings to your assessment questions and record any manual checks or configuration evidence separately.

  3. Keep the context

    Use available report exports and retain the review scope. Compare later scans without treating missing detections as confirmed fixes.

Using reports in other frameworks or vendor reviews

For SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, CCPA/CPRA, or DORA reviews, ask your assessor which application evidence is relevant. These pages do not provide automated control mappings or legal determinations for those frameworks.

The app’s business context, data handling, and organizational controls require evidence beyond a scan.

This is product guidance, not legal advice. A qualified assessor or counsel can determine how the evidence applies to your obligations.