APK Security & Privacy Analyzer

Static analysis for Android apps, straight from an APK link. No emulator, no device, no MobSF server to maintain. Paste one or more APK URLs and get a structured JSON report per app:

• Third-party trackers & SDKs: 85+ analytics, attribution, advertising, session-replay, location and fingerprinting SDKs (Firebase, AppsFlyer, Adjust, Meta, AppLovin, Sentry, Hotjar, OneSignal and more), with matched class counts as evidence.
• Hardcoded secrets: AWS keys, private keys, Stripe, GitHub, Slack, OpenAI, Anthropic, SendGrid, Twilio, Mapbox, Google API keys and more. Values are masked by default; a SHA-256 of each value is always included.
• Network surface: every embedded domain and URL, plain-HTTP endpoints, and cloud backends worth checking (Firebase Realtime Database, Firebase Storage, S3 buckets, Azure Blob, Supabase, API Gateway).
• Manifest risks: debuggable builds, ADB backup, cleartext traffic, outdated targetSdk, exported services/receivers/providers without permission, dangerous and sensitive permissions.
• Signing: v1/v2/v3 schemes, certificate subject, SHA-256 fingerprint, validity, key size, debug-certificate detection, Janus-vulnerable v1-only signing.
• Build info: Flutter, React Native, Unity, Xamarin, Cordova and Compose detection, native ABIs and libraries, DEX/class counts.

Every finding has a severity (critical → info), so you can sort and filter a batch of apps in seconds.

Quick start

1. Click Start. The default input analyzes the open-source F-Droid client.
2. Replace the URL with your own APK links (.apk, .xapk, .apks, .apkm are all accepted).
3. Open the Overview, Findings or Trackers tab of the dataset, or export to JSON, CSV or Excel.

The link must return the file itself, not a web page with a download button.

Input

Field	Default	Description
apkUrls	F-Droid	Direct download URLs, one report per URL
maskSecrets	true	Show only the start and end of detected secrets
scanAssets	true	Also scan assets/ and res/raw/ text files and JavaScript bundles
maxUrls	500	Max URLs listed per report (domains are always complete)
maxApkSizeMb	300	Skip larger downloads

{
    "apkUrls": [{ "url": "https://f-droid.org/F-Droid.apk" }],
    "maskSecrets": true
}

Real example: F-Droid

The default input is ready to run: https://f-droid.org/F-Droid.apk. In a completed analysis on October 28, 2026, the Actor returned the following results for F-Droid 2.0.2 (org.fdroid.fdroid):

Report field	Observed result
Analysis status	ok
Target SDK	37
Highest finding severity	medium
Detected tracker SDKs	0
Potential secrets	0
Dangerous permissions	7
Exported components	10
Embedded domains	53

Open Overview for this summary and Findings for the evidence behind individual warnings. These are static-analysis findings, not a verdict that an app is malicious or free of vulnerabilities. The download URL points to the latest F-Droid release, so versions and results can change.

Output (abridged)

{
    "sourceUrl": "https://example.com/app.apk",
    "status": "ok",
    "packageName": "com.example.app",
    "versionName": "5.2.0",
    "targetSdk": 34,
    "summary": {
        "highestSeverity": "high",
        "severityCounts": { "critical": 0, "high": 1, "medium": 2, "low": 3, "info": 1 },
        "trackerCount": 7,
        "secretCount": 2,
        "dangerousPermissionCount": 5,
        "exportedComponentCount": 9,
        "domainCount": 64
    },
    "findings": [
        { "id": "hardcoded-secret", "severity": "high", "title": "Hardcoded Slack webhook", "detail": "Found in assets/config.json (1x): https…a1B2" }
    ],
    "trackers": [
        { "name": "AppsFlyer", "category": "attribution", "matchedClasses": 412, "evidence": "com.appsflyer.AppsFlyerLib" }
    ],
    "secrets": [ "…" ],
    "network": { "domains": [ "…" ], "urls": [ "…" ], "cleartextUrls": [ "…" ], "cloudEndpoints": [ "…" ] },
    "manifest": { "flags": { "debuggable": false, "allowBackup": true, "usesCleartextTraffic": false }, "permissions": { "…": "…" }, "exportedComponents": [ "…" ] },
    "signing": { "schemes": { "v1": false, "v2": true, "v3": true }, "certificates": [ "…" ] },
    "build": { "frameworks": ["React Native"], "nativeAbis": ["arm64-v8a"], "classCount": 53239 },
    "file": { "sha256": "…", "md5": "…", "sizeBytes": 40457062, "format": "apk" }
}

Failed downloads or invalid files produce an item with "status": "error" and a readable error message. Failed items are not charged.

Use cases

• Privacy & GDPR audits: list every tracker and data-collecting SDK in an app before release or procurement.
• Mobile pentest recon: secrets, exported components and backend endpoints in seconds, before you open jadx.
• Bug bounty: triage dozens of in-scope APKs for leaked keys and open Firebase/S3 backends.
• Vendor & third-party risk: check the apps your company depends on.
• Competitive research: see which analytics, ad networks and frameworks competitors use.
• AI agents: one clear input, structured output, ready for MCP and agent tool calls.

Pricing

$0.08 per successfully analyzed APK ($80 per 1,000). Platform usage for the analysis is included. No start fee. Failed downloads and invalid files are not charged.

Successfully analyzed APKs	Analysis price (USD)
1	$0.08
10	$0.80
100	$8.00
1,000	$80.00

Prices above cover the analysis event. Any separate Apify charges for keeping or accessing stored results are governed by your Apify plan.

How it works

The Actor downloads each file, unwraps split bundles, parses the binary manifest and signing blocks with Androguard, and reads DEX string tables directly. It does not decompile or execute code. Runtime depends on APK size, download speed and bundled files. A complete F-Droid demo run took about 90 seconds in our launch test; other runs can be faster or slower.

Limitations

• Static analysis only: code that is downloaded at runtime, encrypted or heavily obfuscated strings will not be seen.
• Tracker detection uses package names; SDKs that are renamed by obfuscation may be missed.
• A detected key is not necessarily valid or exploitable. Verify findings before reporting them.

Where to get an APK link

The input must be a direct link to the file. Typical sources:

• Your own builds: CI artifacts, GitHub Releases, S3 or any file host. The most common use for audits of your own apps.
• Open-source app stores: F-Droid and similar publish direct .apk links.
• Vendor download pages that link straight to the .apk, .xapk, .apks or .apkm file.

A link to a web page with a "Download" button will not work: the Actor tells you so in the error field and does not charge for it.

Use it from code

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("bifras/apk-security-analyzer").call(
    run_input={"apkUrls": [{"url": "https://f-droid.org/F-Droid.apk"}]}
)
for report in client.dataset(run["defaultDatasetId"]).iterate_items():
    if report.get("status") != "ok":
        print("Analysis failed:", report.get("sourceUrl"), report.get("error", "Unknown error"))
        continue
    print(report["packageName"], report["summary"]["highestSeverity"])
    for finding in report["findings"]:
        print(" -", finding["severity"], finding["title"])

It also works with the Apify API, scheduled runs (re-check every release), webhooks, Make, Zapier and n8n. Use a webhook to fail a CI job when summary.highestSeverity is high or critical.

FAQ

Does it run the app? No. It reads the manifest, signing block, DEX string tables and bundled assets. Nothing is executed, only parsed, and the analysis runs in an isolated Apify container.

Why did it find no trackers in my app? Tracker detection matches package names. Heavily obfuscated builds (renamed packages) can hide SDKs. Compare with build.classCount and the endpoints list.

Is a detected secret a real leak? Not always. Public client keys (for example Google Maps or Firebase API keys) are meant to ship in apps; the severity reflects the typical impact if the key is unrestricted. Verify before reporting.

Are my APKs stored? The file is downloaded for the run and analyzed in memory. Only the report is stored in your dataset.

Can it analyze iOS apps? Not yet. Android only.

Responsible use

Analyze apps you own, apps you are authorized to test, or publicly distributed apps for research. Do not use detected credentials against third-party services. Report leaked secrets to the app owner.