Reference library
Finding categories
Explore recorded detections in public app releases. Counts describe apps with matches, not confirmed current exposure.
Browse the library
Apps with embedded credential findings
Android apps found shipping a hard-coded secret — an API key, access token, private key or credential — in their public release.
Apps with a Firebase Realtime Database
Android apps that ship a Firebase Realtime Database URL. A reference is not an exposure; it becomes one when the rules let an unauthenticated caller read the data, which a scan checks and records the date of.
Apps with a Firebase Storage bucket
Android apps with a recorded Firebase Storage bucket. A reference does not establish access; a bucket confirmed to answer an anonymous request carries the date that check ran.
Apps with Cloud Firestore findings
Android apps whose Cloud Firestore data was confirmed readable without authentication. Firestore is reported only on confirmation, never from a reference, so every entry carries the date of that check.
Apps with an Amazon S3 bucket
Android apps referencing an Amazon S3 bucket. The risk is real only if the bucket is publicly listable, which an anonymous listing request establishes without using any credential.
Apps with a Google Cloud Storage bucket
Android apps with a recorded Google Cloud Storage reference. Current access is not established by a reference.
Apps shipping a debuggable build
Android apps that shipped android:debuggable="true" to production — exposing internals and never intended for release.
Apps permitting cleartext (HTTP) traffic
Android apps whose manifest permits plaintext HTTP. This is a configuration signal, not evidence that sensitive data was transmitted.
Apps with signing-metadata findings
Android apps signed with a debug key, a weak algorithm (SHA-1/MD5), a short key, an expired cert, or v1-only signatures.
Apps bundling a known-vulnerable library (CVE)
Android apps shipping a third-party library whose version matches a public security advisory (CVE).
Apps with a Supabase backend
Android apps shipping a Supabase project URL or its anon key. Both are public by design; whether the data behind them is protected depends entirely on Row Level Security.
Apps using object storage outside AWS and Google Cloud
Android apps referencing buckets on DigitalOcean Spaces, Alibaba Cloud OSS, Backblaze B2 or Wasabi — S3-compatible storage where the same misconfigurations apply but attract far less scanning attention.
Apps with hard-coded usernames and passwords
Android apps shipping an actual credential pair — embedded in a URL as user:password@host, or as a pre-built HTTP Basic authorization header. Unlike an API key, this is a login.
Apps shipping a Sentry DSN
Android apps containing a Sentry DSN. A client DSN is public by design, so the question this raises is not the key — it is what the crash reports carry.
Apps whose Play Data Safety label does not match the app
Android apps where the public Google Play Data Safety declaration contradicts what static analysis observes in the APK — either no data sharing is declared while third-party ad or analytics SDKs ship, or an observed data category is missing from the label.
Apps with an exported content provider and no permission
Android apps declaring a ContentProvider as exported without requiring a permission, so any other app on the device can attempt to query it.
Apps with application backup enabled
Android apps whose manifest explicitly states android:allowBackup="true", allowing application data to be included in device and cloud backups. Reported for the record and deliberately not scored.
Apps requesting background location with advertising SDKs present
Android apps declaring background location access while also shipping advertising or analytics SDKs — a combination Google Play singles out for extra scrutiny and one of the few permission patterns with a specific policy attached.
Apps shipping a Google API key
Android apps containing a Google API key. Client keys are designed to ship inside apps, so this is a prompt to check the key's restrictions rather than a leak in itself.
Apps with an embedded crypto wallet seed phrase
Android apps found embedding a checksum-valid BIP39 mnemonic — the master key to a crypto wallet.
No matching records. Change or clear your filters.
Mappings describe review evidence. They do not establish exploitability, a compliance failure, or a clean result.