Every Layer of
Application Security

From APK binary heuristics to repository SAST and dependency CVE scanning — Strata Security covers your entire attack surface, mobile and source code alike.

Looking for the product overview instead? See the Commercial Platform page.

Platform Capabilities

🔍

Static Analysis Engine

No runtime instrumentation. Strata Security analyses APK/IPA binaries and source repositories purely from static signals — manifests, bytecode, source files, and metadata.

Binary & SourceZero runtime
🦠

VirusTotal Integration

Every mobile scan SHA-256 hash is cross-referenced against 70+ antivirus engines via the VirusTotal API. Malware flags appear directly in your report.

Malware70+ engines
🔑

Secret & Credential Detection

Regex-backed scanning surfaces hardcoded API keys, OAuth tokens, private keys, and connection strings across every file in a repository — before they reach production.

SecretsCredentialsTokens
📦

Dependency CVE Scanning

Package manifests are parsed (npm, PyPI, Maven, Gradle) and every dependency is checked against the OSV database for known CVEs — with severity, fix version, and CVE IDs.

CVEsOSVnpm · PyPI · Maven
🏢

Team Workspaces

Invite your security team, organise scans into projects, and share findings across your organisation with role-based access control.

TeamsProjectsRBAC

Results in <60 Seconds

Optimised pipeline processes most APKs and IPAs in under 30 seconds. Repository scans — including SAST and dependency lookups — typically complete in under 60 seconds.

FastAsync
🔒

Private & Secure

Files are streamed directly to the analysis engine. Content hashing prevents duplicate processing. No file is stored longer than your retention policy.

EncryptedSHA-256GDPR-ready

See our full security practices →

📊

Unified Risk Scoring

Every assessment — mobile or repository — produces a risk level (Critical / High / Medium / Low) based on weighted findings, CVE severity, and secret confidence.

CVSS-styleWeighted

APK Analysis — In Depth

Permission Intelligence

Strata Security cross-references every declared permission against a curated catalog of dangerous, signature-level, and normal permissions. Each one is rated for risk and mapped to OWASP categories.

Special attention is paid to critical permissions like READ_CALL_LOG, SYSTEM_ALERT_WINDOW, and REQUEST_INSTALL_PACKAGES.

Dangerous permission detection with severity ratings
Signature and privileged permission flagging
Permission combination analysis (e.g. SMS + internet)
Over-permissioned app detection
Permission Analysis
READ_CALL_LOGCRITICAL
SYSTEM_ALERT_WINDOWHIGH
REQUEST_INSTALL_PACKAGESHIGH
READ_EXTERNAL_STORAGEMEDIUM
ACCESS_FINE_LOCATIONMEDIUM
RECORD_AUDIOMEDIUM
INTERNETINFO
ACCESS_NETWORK_STATEINFO

Manifest & DEX Analysis

Beyond permissions, Strata Security inspects the full AndroidManifest.xml for exported components, debug flags, backup settings, and cleartext traffic declarations.

DEX bytecode string scanning catches embedded secrets, hardcoded API keys, suspicious URLs, and obfuscation bypass patterns that bypass manifest-only scanners.

Exported Activity / Service / Provider detection
android:debuggable and android:allowBackup flags
Cleartext traffic (usesCleartextTraffic)
Hardcoded secrets in DEX strings
Suspicious URL patterns (ngrok, internal IPs)
Manifest Flags
android:debuggabletrue ⚠
usesCleartextTraffictrue ⚠
android:allowBackuptrue ⚠
Exported activities3 found
DEX strings — suspicious:
https://192.168.1.100/api/v1
AIzaSyD…[truncated]

IPA Analysis — In Depth

App Transport Security & Info.plist

iOS security largely lives in two places: Info.plist and the App Transport Security configuration. Strata Security reads both in full and surfaces every exception and unsafe configuration.

ATS exceptions that disable HTTPS, allow arbitrary loads, or exempt specific domains are flagged with severity ratings aligned to OWASP M5 (Insecure Communication).

NSAllowsArbitraryLoads and domain exceptions
NSExceptionAllowsInsecureHTTPLoads per domain
Minimum TLS version enforcement
Privacy usage description completeness
Entitlement over-privilege analysis
ATS Configuration
NSAppTransportSecurity: {
  NSAllowsArbitraryLoads: true // ⚠ M5
  NSExceptionDomains: {
    "api.example.com": {
      NSTemporaryExceptionAllowsInsecureHTTPLoads:
      true // ⚠ HIGH
    }
  }
}
Arbitrary loadsInsecure domainOWASP M5

Repository Scanning — In Depth

Secret & Sensitive File Detection

Strata Security walks every file in a cloned or uploaded repository looking for hardcoded secrets — API keys, OAuth tokens, private key material, database connection strings, and more — using a curated set of high-signal regex rules.

Sensitive file patterns (private keys, .env, credentials.json, SSH keys) are detected regardless of content and flagged before they can be exploited post-leak.

AWS, GCP, Azure, and generic API key patterns
OAuth client secrets and bearer tokens
RSA / EC private key material
Committed .env files, service account JSON, and keystore files
Confidence scoring (high / medium) to minimise noise
Secret Findings
AWS_ACCESS_KEY_IDCRITICAL
stripe_secret_keyCRITICAL
GITHUB_TOKENHIGH
DATABASE_URLHIGH
google_oauth_secretMEDIUM
⚠ Sensitive file detected
config/service-account.json

SAST & Code Vulnerability Analysis

Strata Security's static application security testing engine scans Python, JavaScript/TypeScript, Java, Go, Ruby, PHP, and more — flagging injection sinks, unsafe deserialization, path traversal, weak cryptography, and other exploitable patterns.

Every finding is mapped to an OWASP Web Top 10 (2021) category and a CWE identifier, giving developers the exact remediation context they need without leaving the report.

SQL injection, command injection, and path traversal
XSS and unsafe HTML rendering
Insecure deserialization and unsafe eval / exec
Weak cryptography (MD5, SHA-1, ECB mode)
Per-finding OWASP A1–A10 and CWE mapping
SAST Findings
SQL InjectionCRITICAL
api/db.py:84A3CWE-89
Command InjectionHIGH
utils/run.js:22A3CWE-78
Weak CryptographyMEDIUM
auth/hash.py:11A2CWE-327

Dependency CVE Scanning

Strata Security parses every package manifest it finds — package.json, requirements.txt, pom.xml, Gradle build files, and lockfiles — then queries the OSV (Open Source Vulnerabilities) database for known CVEs in each pinned version.

Results include the CVE IDs, CVSS severity, the earliest available fix version, and a direct link to the advisory — giving engineers the exact upgrade target without additional research.

npm / yarn (package.json + lockfile)
PyPI (requirements.txt, Poetry, Pipfile)
Maven and Gradle (pom.xml, build.gradle)
CVE IDs, CVSS severity, and fix version per finding
Mapped to OWASP A6 — Vulnerable & Outdated Components
Dependency CVEs
lodash@4.17.20HIGH
CVE-2021-23337npmfix → 4.17.21
requests@2.25.1MEDIUM
CVE-2023-32681PyPIfix → 2.31.0
log4j-core@2.14.1CRITICAL
CVE-2021-44228Mavenfix → 2.15.0
Sources parsed: package.json, requirements.txt, pom.xml

Reports Clients Actually Read

Strata Security generates structured, professional-grade security reports — ready to send directly to development teams or executive stakeholders.

📑

Executive Summary

Every PDF opens with a high-level risk overview — overall score, finding counts by severity, and the highest-priority issues. Designed for both developers and executive stakeholders.

🔬

Finding Evidence

Each finding includes the exact code or config snippet that triggered it, the affected file and line, OWASP category, and CWE identifier for full traceability.

🛠

Remediation Guidance

Every finding ships with actionable fix instructions — tailored to the language and framework. No vague recommendations, just the specific change needed.

⬇️

Multiple Export Formats

Export as a polished PDF for delivery or structured JSON for CI/CD integration. Repository reports include OWASP Web Top 10 and CWE mapping sections.

PDFJSONCSV (soon)

Start Scanning for Free

1 scan per day, no credit card required. Upgrade when you need more.