Security & data handling
What is visible, what is retained, and how to interpret the evidence in a scan report.
Your data at a glance
Private APK uploads
Sign in to upload an APK. Its report is visible to the signed-in owner. Public package reports remain available for browsing.
Results remain available
Reports retain build metadata, findings, redacted evidence, and coverage details. Uploaded APK binaries are removed after processing.
Sensitive values are redacted
Detected secrets are represented by redacted displays and keyed fingerprints. Reports do not provide a way to reveal the original secret.
Account information
Sign-in, billing, and communication data are separate from APK findings. Read the Privacy Policy for how account information is handled.
Analysis safeguards
Static analysis
New scans inspect APK contents without contacting detected backends. Older verification records apply only to their recorded scan time.
Explicit limitations
New reports include analysis completeness and build context. Incomplete scans are not graded; older records with unknown coverage are labeled.
How APK processing is isolated
The parser runs with container networking disabled, a read-only root filesystem, and resource limits. It has no database or application-session credentials. Extraction rejects unsafe paths and applies archive limits.
These controls reduce risk; they do not make processing untrusted files risk-free.
What a report establishes
Recorded evidence
A report describes a particular build and scan time. A signed Proof Capsule can establish document origin and integrity. It does not certify that an app is safe.
Verify a Proof Capsule →Independent assurance
We do not offer a SOC 2 report or claim that a scan certifies regulatory compliance. Contact us to discuss the assurance documentation your review requires.
Use findings in an assessment →Report an issue or request a correction
For a security issue in this service or a concern about a finding, contact security@apk-scanner.com. Include the affected report URL and a description; avoid sending raw credentials.
For privacy and takedown information, see the Privacy Policy and Terms.