Frequently asked questions

Static analysis examines the APK for embedded key patterns, cloud references, manifest settings, and recognizable SDKs. Each report records build details and analysis coverage. Scans check whether a referenced backend answers an unauthenticated request, never using a detected credential and never reading stored data.

A finding category groups a type of detection. Occurrences are individual matches within that category. One category can contain many occurrences; read both counts when comparing reports.

No. The score summarizes recorded findings, weighted by severity and finding class. It cannot establish the absence of other issues. Incomplete scans are not graded, and historical scans with unknown coverage are qualified.

A verified finding means the referenced backend answered an unauthenticated request at the time of the check. It establishes reachability on that date, not today, and says nothing about what the backend would return to an authenticated caller. Verification applies to the date it ran; inspect the date and coverage before interpreting a result.

No. Apps commonly contain service URLs and client identifiers. A static match alone does not show that a credential works or that a backend permits public access. Review the category guidance and your own configuration.

Yes. Sign in to upload a private APK from the home page. Free accounts have 3 scan attempts per day and can watch 3 apps. Compare plans for higher limits and API/export access.

Uploaded APK reports are private to the signed-in owner. Public package reports can be browsed without signing in. Uploaded binaries are removed after processing; report metadata and redacted findings remain available.

An APK may contain unsupported, malformed, or oversized content, or a processing step may fail. Read the report’s coverage and limitations. Missing findings in an incomplete scan cannot establish that the APK is clean.

Opening a cached report does not. A new scan attempt uses the allowance, including an attempt that fails. The account page shows your plan and usage.

No. Watching follows changes between recorded scans. Availability and processing schedules can vary. Check the report’s build identifier and scan date to see which release was assessed.