Android app security assessment
without the source code.
Strata performs static analysis on Android APK files — parsing the manifest, DEX bytecode, signing certificates, and embedded assets to surface real security issues with OWASP mapping, severity scoring, and remediation guidance. Results in under 30 seconds.
What is APK security scanning?
Static analysis of compiled Android binaries
An APK (Android Package) is a ZIP archive containing compiled Dalvik/ART bytecode (classes.dex), native libraries (.so files), the AndroidManifest.xml, resources, and assets. APK security scanning is the process of examining those artifacts — without running the app — to identify security issues before they reach users.
Static analysis works from the compiled binary: it does not execute the application, does not require a device, and does not require access to the original source code. This makes it practical for third-party assessments, supply chain review, and pre-release validation alike.
Static analysis has clear limits: it cannot observe runtime behavior, intercept live network traffic, or test server-side logic. Strata focuses on what static analysis does reliably well — manifest configuration, embedded string scanning, signing integrity, and structural red flags.
Android security issues Strata detects
These are the most common security problems found in real Android applications — each one detectable through static analysis of the compiled APK.
Dangerous permissions with no clear purpose
Permissions like READ_SMS, READ_CALL_LOG, and RECORD_AUDIO are frequently declared in apps that have no legitimate need for them — either left over from copy-pasted code or intentionally abusive. Each is cross-referenced against OWASP M1 (Improper Platform Usage) and M6 (Insecure Authorization).
Cleartext HTTP traffic
android:usesCleartextTraffic="true" in the manifest, missing or misconfigured Network Security Config, and HTTP URLs found in DEX bytecode are all indicators that data may be transmitted without transport encryption.
Hardcoded API keys and credentials
API keys, tokens, and secrets embedded directly in compiled DEX bytecode are extractable by anyone who unpacks the APK. Strata scans DEX strings for over a dozen credential patterns — AWS, Google, Stripe, GitHub, Slack, and more.
Exported components without access control
Activities, services, receivers, and content providers marked exported="true" without a permission attribute are accessible to any app on the device. Strata identifies all exported components and flags those with no protection.
V1-only APK signing (Janus vulnerability)
APKs signed only with the v1 (JAR) scheme are vulnerable to CVE-2017-13156, which allows an attacker to prepend malicious DEX bytecode without invalidating the signature. V2 or V3 signing is required to close this.
Missing or weak certificate pinning
When no certificate pinning is configured in the Network Security Config, the app trusts any CA in the device's trust store — including user-installed CAs — making it straightforward to intercept HTTPS traffic with a proxy.
What Strata checks
Every check listed below is performed automatically on every APK scan. All analysis is static — no emulator, no device, no source code.
Manifest & permissions
Hardcoded secrets
Network security
Signing & certificates
Package structure & assets
Behavioral indicators
From upload to remediation
APK security scanning is only the first step. Strata gives you the workflow to act on what you find.
Upload the APK
Upload the APK file directly in the browser — no build system access, source code, or device required. Strata accepts any valid APK up to 500 MB.
Static analysis runs
Androguard parses the manifest, DEX bytecode, and assets. String scanning, heuristics, signing analysis, NSC parsing, and VirusTotal lookup run in parallel. Results are typically ready in under 30 seconds.
Review severity-ranked findings
Findings are ranked by severity (Critical → High → Medium → Low) with OWASP Mobile category, plain-English explanation, and concrete remediation guidance for each.
Triage and track
Move findings through a lifecycle: Open → In Progress → Fixed or Accepted Risk. Add notes, mark false positives, and maintain a clear picture of what still needs remediation.
Export a client-ready report
Generate a PDF report with executive summary, CVSS severity breakdown, OWASP coverage, and per-finding evidence — suitable for developer handoff or client delivery.
Why findings lifecycle matters
A scan report is not a remediation plan
Most APK scanners produce a report — a snapshot of what was found at a point in time. Without a way to track findings through remediation, those reports accumulate. Developers do not know what is fixed, what is still open, or what was deliberately accepted as a risk.
Strata gives each finding a lifecycle: Open → In Progress → Fixed or Accepted Risk. Status is tracked across rescan runs, so when you upload a new build, you can see exactly which findings were resolved and which are still present.
This is particularly important for recurring assessments and client reporting — rather than delivering another static PDF, you can show a measurable change in security posture over time.
Common Questions
See Strata in action
Watch a walkthrough of the platform — from upload to full security report.
Demo video coming soon
Get a personalized walkthrough of Strata — we will cover your specific workflow live.
Request a Demo →Run your first APK scan
in under 30 seconds.
Free to start — upload an APK and get a full security assessment with no credit card required. Upgrade for unlimited scans, findings lifecycle, and client-ready reports.