Is it secure?
Manifest and Info.plist configuration, exported components, network security and App Transport Security, crypto and storage APIs, signing, native binary hardening and hardcoded secrets.
Mobile app security · Android & iOS
Trust what
you ship.
APPCHK checks your APK, AAB or IPA for security flaws, privacy gaps and App Store or Google Play review problems before you ship, and shows the evidence behind every answer, so you can trust every release.
Early access, invite only.
What it answers
Four questions, before you submit.
Will it pass review?
Purpose strings, privacy manifests and required-reason APIs, third-party SDK manifests, tracking transparency, target API level, restricted Play permissions and 16 KB page size.
What is inside it?
Every SDK and library, a CycloneDX SBOM, and known vulnerabilities matched only when a version is actually identified.
How does it behave?
Network traffic, runtime instrumentation and file changes on emulators and devices, with explicit authorization and verified cleanup.
Evidence, not guesses
From the standard to the exact line.
Every finding is traced through the OWASP chain to the attribute, symbol or string that triggered it.
Control
MASVS-RESILIENCE-4Anti-dynamic analysisWeakness
MASWE-0063Debug mechanisms not disabledTest
MASTG-TEST-0226Debuggable flag in the manifestEvidence
android:debuggable="true"AndroidManifest.xmlHonest coverage
Zero findings never means “secure”.
Every check reports what it did, what it could not do, and why. You always see coverage, not just a score.
- passed
Checked, and the control is met.
- failed
Checked, with evidence of a problem.
- inconclusive
Checked, but the evidence is not enough to decide.
- not tested
Applies, but could not run here, and the report says why.
- not applicable
Does not apply to this app.
- error
The check itself failed, never hidden.
Standards built in
Mapped, pinned and checked every day.
Catalogs are pinned to exact versions, validated against each other, and checked for upstream changes daily.
- OWASP MASVSv2.1.0
- OWASP MASTGv2.0.0
- OWASP MASWEv1.0.0
- CWE4.20
- CVE
- CVSS3.1 · 4.0
- OWASP Mobile Top 102024
- NIST SSDF1.1
- MITRE ATT&CK Mobilev19.2
- PCI DSSv4.0.1
Your build stays yours
Runs where your code already lives.
On your machine, offline
- Linux, macOS and Windows, one native binary
- No uploads, no telemetry
- JSON, SARIF, HTML and PDF reports
- Deterministic exit codes for CI
The same engine, for teams
- Scan history and release-to-release diffs
- Team triage and suppression
- App Store and Google Play review-status alerts
- Slack, webhooks and issue trackers
Early access
Ship with evidence.
APPCHK is invite only while we onboard the first teams. Request access and we will send your invite.