Find a topic, review the instructions in context, and check the current analysis scope.
Guide updated · 2026-09-05
Three ways to find leaked API keys, tokens and credentials inside an Android APK — manual decompilation, string grepping, and automated static analysis with redacted evidence.
Guide updated · 2026-09-05
Your Firebase Realtime Database is world-readable because its security rules allow unauthenticated reads. Here's how to confirm it, lock it down, and handle the exposed data.
Guide updated · 2026-09-10
Use recorded APK findings as input to a broader assessment, with coverage and limitations attached.
Guide updated · 2026-09-10
Use recorded APK findings as input to a broader assessment, with coverage and limitations attached.
Guide updated · 2026-09-05
Cleartext traffic lets your app send data over unencrypted HTTP, exposing it to interception. Here's how to detect it and disable it with a Network Security Configuration.
Guide updated · 2026-09-05
The store listing won't tell you if an app leaks data or ships known vulnerabilities. Here's what to actually check — permissions, trackers, and a real exposure scan.
Guide updated · 2026-09-05
Apps bundle third-party libraries that can carry known CVEs. Here's how to build an SBOM of an app's components and match it against vulnerability data.
Guide updated · 2026-09-05
Every Android app is signed to prove its origin — but the signature scheme matters. Here's v1 vs v2/v3, the Janus tampering attack, and how to check your app.
Guide updated · 2026-09-07
A practical pre-release checklist for Android apps: secrets, cloud backends, network, signing, exported components, dependencies, privacy, and build hygiene.
Guide updated · 2026-09-07
An exported component with no permission is callable by any app on the device — a common IPC, privilege-escalation and data-leak vector. Here's how to lock them down.
Guide updated · 2026-09-07
You can't safely ship a real secret in a client app — anything in the binary is extractable. The right patterns: keep secrets server-side, use the platform keystore, and restrict any key that must ship.
Guide updated · 2026-09-10
Use recorded APK findings as input to a broader assessment, with coverage and limitations attached.
No matching records. Change or clear your filters.