Corpus statistics

Recorded security & privacy signals

Latest available public scan per app · Generated 2026-10-14 14:06 UTC

Explore app reports

These are recorded detections, not a representative sample of all Android apps. Verification applies only to the date the check ran. Missing findings or inventories do not establish absence.

Public apps with reports6498
Recorded tracker presence5985Apps with at least one recorded tracker
Historical verification366Apps with dated verification records
Assessment distribution

Incomplete scans are not graded. Historical grades with unknown coverage remain qualified in individual reports; a grade is not a safety guarantee.

A4858
B950
C104
D222
F180
Not graded184
Trackers & SDKs

Average trackers per recorded inventory: 8.1. Missing inventories are excluded from this average. Counts below describe apps with recorded matches.

Google Firebase Analytics5581
Google AdMob5557
Google Analytics for Firebase5003
IAB TCF4871
Google Tag Manager4692
Google Crashlytics3799
Google UMP (consent)2005
Meta / Facebook SDK1720
Meta Audience Network1435
AppLovin1403
AppsFlyer1399
Vungle1084
Common finding labels

Number of apps with each recorded label. Different labels may belong to the same finding category.

Google API key (client-shipped; restriction unverified)5558
Firebase Storage bucket reference4055
Firebase Realtime Database reference2960
Application data is backup-enabled2476
Cleartext (HTTP) traffic permitted1415
Short signing key (RSA 1024-bit)1009
Amazon S3 bucket reference1000
Sentry DSN727
com.squareup.okhttp3:okhttp 3.12.13 — CVE-2021-0341555
Exported content provider without permission (third-party library artifact, shared across 403 unrelated developers)488
Build & component signals
Selected high-severity data findings612
Cleartext traffic permitted1415
Debuggable builds1
V1-only signing detections0

Counts describe apps with a detection. Certificate metadata alone does not demonstrate that an APK is exploitable. Average bundled components per recorded inventory: 82.

Recorded advisory labels

CVE-2021-0341 (fixed in 4.9.2)907
CVE-2021-0341 (fixed in 4.9.0)30
Methodology & citation

Each public app contributes its latest available scan. Build dates and analysis coverage differ. Counts are limited to the corpus and checks performed; they do not measure the prevalence of risks across the Android ecosystem. Scans check whether a referenced backend answers an unauthenticated request, never using a detected credential and never reading stored data.

Cite: apk-scanner.com, Recorded security & privacy signals, generated 2026-10-14 14:06 UTC (6498 public app reports). apk-scanner.com/stats. For app-specific claims, cite the dated report.

Signed evidence establishes provenance and integrity of the recorded assessment, not current reachability or compliance.