From APK to evidence you can review

Static analysis of a recorded build, with redacted findings and explicit coverage.

Three steps to a useful report

  1. Choose an APK

    Look up a Google Play package or sign in to upload your own build. Uploaded reports are private to their owner.

  2. Review the findings

    Inspect grouped detections, redacted occurrences, manifest settings, and SDK inventories alongside analysis coverage.

  3. Compare recorded builds

    Watch an app and compare scan dates, build identifiers, and changes in detections.

Read the context before the score

1. Build & date

Confirm the app version and scan time. A report describes that recorded build.

2. Analysis coverage

Check whether analysis completed. Incomplete or unknown coverage limits what missing findings mean.

3. Categories & occurrences

Categories group types of findings. Occurrences count individual matches. Expand a category to inspect its evidence.

4. Grade & changes

Grades summarize recorded findings. A removed detection does not by itself confirm a fix or revoked credential.

What the evidence can tell you

Static detections

APK contents can reveal key patterns, service references, manifest risks, and recognizable tracking SDKs. A cloud reference alone does not establish public access.

Explore detection coverage →

Historical verification

Some older scans contain checks made at the recorded scan time. These records do not establish current reachability. New scans do not probe detected backends.

Read the historical-evidence explanation →

A grade is not a guarantee of app safety. Signed evidence establishes the document’s origin and integrity; it does not certify complete security testing.

Processing details
  1. Acquire: obtain an available package or accept an authenticated APK upload.
  2. Extract: parse supported APK contents within size and processing limits.
  3. Detect: record pattern matches and metadata with sensitive values redacted.
  4. Record coverage: preserve stage outcomes, limitations, and build identifiers.
  5. Store the report: retain results and remove the uploaded binary after processing.

Grades use severity and finding-class weights. Incomplete scans are not graded; older scans without coverage metadata are labeled accordingly.