Every Layer of
Application Security
From APK binary heuristics to repository SAST and dependency CVE scanning — Strata Security covers your entire attack surface, mobile and source code alike.
Looking for the product overview instead? See the Commercial Platform page.
Platform Capabilities
Static Analysis Engine
No runtime instrumentation. Strata Security analyses APK/IPA binaries and source repositories purely from static signals — manifests, bytecode, source files, and metadata.
VirusTotal Integration
Every mobile scan SHA-256 hash is cross-referenced against 70+ antivirus engines via the VirusTotal API. Malware flags appear directly in your report.
Secret & Credential Detection
Regex-backed scanning surfaces hardcoded API keys, OAuth tokens, private keys, and connection strings across every file in a repository — before they reach production.
Dependency CVE Scanning
Package manifests are parsed (npm, PyPI, Maven, Gradle) and every dependency is checked against the OSV database for known CVEs — with severity, fix version, and CVE IDs.
Team Workspaces
Invite your security team, organise scans into projects, and share findings across your organisation with role-based access control.
Results in <60 Seconds
Optimised pipeline processes most APKs and IPAs in under 30 seconds. Repository scans — including SAST and dependency lookups — typically complete in under 60 seconds.
Private & Secure
Files are streamed directly to the analysis engine. Content hashing prevents duplicate processing. No file is stored longer than your retention policy.
Unified Risk Scoring
Every assessment — mobile or repository — produces a risk level (Critical / High / Medium / Low) based on weighted findings, CVE severity, and secret confidence.
APK Analysis — In Depth
Permission Intelligence
Strata Security cross-references every declared permission against a curated catalog of dangerous, signature-level, and normal permissions. Each one is rated for risk and mapped to OWASP categories.
Special attention is paid to critical permissions like READ_CALL_LOG, SYSTEM_ALERT_WINDOW, and REQUEST_INSTALL_PACKAGES.
Manifest & DEX Analysis
Beyond permissions, Strata Security inspects the full AndroidManifest.xml for exported components, debug flags, backup settings, and cleartext traffic declarations.
DEX bytecode string scanning catches embedded secrets, hardcoded API keys, suspicious URLs, and obfuscation bypass patterns that bypass manifest-only scanners.
https://192.168.1.100/api/v1
AIzaSyD…[truncated]
IPA Analysis — In Depth
App Transport Security & Info.plist
iOS security largely lives in two places: Info.plist and the App Transport Security configuration. Strata Security reads both in full and surfaces every exception and unsafe configuration.
ATS exceptions that disable HTTPS, allow arbitrary loads, or exempt specific domains are flagged with severity ratings aligned to OWASP M5 (Insecure Communication).
NSAllowsArbitraryLoads: true // ⚠ M5
NSExceptionDomains: {
"api.example.com": {
NSTemporaryExceptionAllowsInsecureHTTPLoads:
true // ⚠ HIGH
}
}
}
Repository Scanning — In Depth
Secret & Sensitive File Detection
Strata Security walks every file in a cloned or uploaded repository looking for hardcoded secrets — API keys, OAuth tokens, private key material, database connection strings, and more — using a curated set of high-signal regex rules.
Sensitive file patterns (private keys, .env, credentials.json, SSH keys) are detected regardless of content and flagged before they can be exploited post-leak.
.env files, service account JSON, and keystore filesconfig/service-account.json
SAST & Code Vulnerability Analysis
Strata Security's static application security testing engine scans Python, JavaScript/TypeScript, Java, Go, Ruby, PHP, and more — flagging injection sinks, unsafe deserialization, path traversal, weak cryptography, and other exploitable patterns.
Every finding is mapped to an OWASP Web Top 10 (2021) category and a CWE identifier, giving developers the exact remediation context they need without leaving the report.
Dependency CVE Scanning
Strata Security parses every package manifest it finds — package.json, requirements.txt, pom.xml, Gradle build files, and lockfiles — then queries the OSV (Open Source Vulnerabilities) database for known CVEs in each pinned version.
Results include the CVE IDs, CVSS severity, the earliest available fix version, and a direct link to the advisory — giving engineers the exact upgrade target without additional research.
Reports Clients Actually Read
Strata Security generates structured, professional-grade security reports — ready to send directly to development teams or executive stakeholders.
Executive Summary
Every PDF opens with a high-level risk overview — overall score, finding counts by severity, and the highest-priority issues. Designed for both developers and executive stakeholders.
Finding Evidence
Each finding includes the exact code or config snippet that triggered it, the affected file and line, OWASP category, and CWE identifier for full traceability.
Remediation Guidance
Every finding ships with actionable fix instructions — tailored to the language and framework. No vague recommendations, just the specific change needed.
Multiple Export Formats
Export as a polished PDF for delivery or structured JSON for CI/CD integration. Repository reports include OWASP Web Top 10 and CWE mapping sections.
Start Scanning for Free
1 scan per day, no credit card required. Upgrade when you need more.