Request access

Product

Everything APPCHK checks.

One scanner for APK, AAB and IPA files. It reads the compiled app the way the platform does, checks everything that applies, and tells you what it found, what it could not check, and why.

APPCHK is in early access. Capabilities roll out in stages; invited teams get them first.

01

How a scan works

From package to evidence in five steps.

  1. Unpack safelyPackages are treated as hostile. Nothing is extracted to disk; size, count and ratio limits stop archive bombs; tricks that hide content from scanners are reported as findings.
  2. ParseBinary manifests, resources, DEX bytecode, Mach-O and ELF binaries, property lists and privacy manifests, decoded the way Android and iOS read them.
  3. AnalyzeHundreds of checks across configuration, code, binaries, secrets, SDKs, store policy and malware indicators.
  4. MapEvery check is tied to OWASP MASVS, MASWE and MASTG, CWE and the OWASP Mobile Top 10, from pinned catalog versions.
  5. ReportEach check ends as passed, failed, inconclusive, not tested, not applicable or error, with evidence. JSON, SARIF, HTML and PDF.
02

Android · APK, AAB, XAPK, APKS, AAR, JAR

Android, from manifest to native code.

Manifest and components

  • Debuggable, backup, test-only and cleartext flags
  • Exported activities, services, receivers and providers, weighed against permission protection levels
  • Task hijacking (StrandHogg) and launch-mode risks
  • Intent filters, deep links and App Links verification
  • Minimum and target SDK risks

Network

  • Network security configuration: cleartext, user certificate trust, pinning, debug overrides
  • Insecure TLS and hostname-verification code
  • WebView settings: JavaScript bridges, file access, mixed content

Signing

  • APK Signature Scheme v1, v2, v3 and v3.1
  • Janus exposure on v1-only signing
  • Debug certificates and weak signature algorithms
  • Certificate details and fingerprints

Code

  • Crypto misuse: weak algorithms, static keys and IVs, insecure random
  • Storage: world-readable files, external storage, unencrypted databases
  • Logging of sensitive data, dynamic code loading, reflection
  • A MobSF-compatible rule set over decompiled sources, plus permission-to-API mapping

Native libraries

  • NX, PIE, stack canaries, RELRO, FORTIFY, RPATH and RUNPATH
  • Stripped symbols and debug artefacts
  • 16 KB page-size alignment for current Google Play requirements

Secrets and trackers

  • Known key formats for cloud, payment and AI providers, plus entropy-based detection
  • Firebase and backend configuration exposure
  • Tracker and SDK inventory from code signatures and domains
03

iOS · IPA, frameworks, dylibs

iOS, from Info.plist to Mach-O.

Configuration

  • Info.plist metadata, URL schemes and supported platforms
  • Permission purpose strings, checked against what the binary links
  • App Transport Security exceptions, TLS minimums, forward secrecy

Entitlements and signing

  • Entitlements from the code signature
  • Provisioning profile: team, expiry, debuggable builds
  • Associated domains and app groups

Binary

  • PIE, stack canaries, ARC, code signature, rpath, stripped symbols
  • FairPlay encryption detection, reported as a limitation instead of a pass
  • Insecure C APIs, weak hashing and random, logging, anti-debugging

Privacy

  • Privacy manifests and required-reason API declarations
  • Third-party SDK manifests and signatures
  • Tracking domains and App Tracking Transparency
04

Supply chain

Know what you ship inside your app.

Inventory with evidence

  • Every SDK and library, with the file it was identified from and a confidence level
  • CycloneDX SBOM export
  • Native libraries and embedded frameworks with their versions

Vulnerabilities, without guesswork

  • Known vulnerabilities from OSV, NVD and the CVE List
  • A CVE is reported only when the library version is actually identified
  • Every report shows how fresh the vulnerability data is
05

Malware indicators

Spot what does not belong.

Package signals

  • Packers, obfuscators, anti-debugging and anti-emulator tricks
  • Permissions most abused by malware
  • Behaviour patterns: SMS, call, file, network and reflection abuse

Network signals

  • Embedded domains checked against malware trail lists
  • Geolocation of resolved hosts, when you allow network lookups
  • Lookups stay off by default; scans are offline and repeatable
06

Runtime

Watch the app run.

Android emulators and devices

  • Traffic capture and TLS tests: cleartext, misconfiguration, pinning
  • Runtime instrumentation and API monitoring
  • File-system and storage changes

Safety first

  • Runs only on a device you name and authorize
  • Cleanup is verified and reported step by step
  • iOS on supported setups, with limits stated in the report
07

Reports and CI

Built for pipelines.

Formats

  • Versioned JSON (the contract)
  • SARIF for code scanning
  • HTML and PDF for people
  • CycloneDX SBOM

Gates

  • Fail on a severity threshold
  • Fail on incomplete scans
  • Deterministic exit codes

Noise control

  • Baselines that survive rebuilds
  • Suppressions with reasons
  • Release-to-release diffs in APPCHK Cloud
08

Early access

See it on your own app.

Invited teams scan their own builds first. Request access and we will send your invite.

Request access Pre-flight

Request access

APPCHK is invite only for now. Leave your email and we will send you an invite when your account is ready.

You are on the list. We will email you as soon as your account is ready.