# APK Analyzer: Android App Security & Privacy Scanner (`bifras/apk-security-analyzer`) Actor

Static analysis of Android APKs, no device or emulator: 85+ tracker SDKs, hardcoded secrets and API keys, risky permissions, exported components, endpoints, cloud backends and signing certificates. Paste APK links, get a JSON report per app. $0.08 per APK, no start fee.

- **URL**: https://apify.com/bifras/apk-security-analyzer.md
- **Developed by:** [Francesco Michael Billeci](https://apify.com/bifras) (community)
- **Stats:** 3 total users, 2 monthly users, 85.7% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$80.00 / 1,000 apks

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## APK Security & Privacy Analyzer

Static analysis for Android apps, straight from an APK link. No emulator, no device, no MobSF server to maintain.
Paste one or more APK URLs and get a structured JSON report per app:

- **Third-party trackers & SDKs**: 85+ analytics, attribution, advertising, session-replay, location and fingerprinting SDKs (Firebase, AppsFlyer, Adjust, Meta, AppLovin, Sentry, Hotjar, OneSignal and more), with matched class counts as evidence.
- **Hardcoded secrets**: AWS keys, private keys, Stripe, GitHub, Slack, OpenAI, Anthropic, SendGrid, Twilio, Mapbox, Google API keys and more. Values are masked by default; a SHA-256 of each value is always included.
- **Network surface**: every embedded domain and URL, plain-HTTP endpoints, and cloud backends worth checking (Firebase Realtime Database, Firebase Storage, S3 buckets, Azure Blob, Supabase, API Gateway).
- **Manifest risks**: debuggable builds, ADB backup, cleartext traffic, outdated targetSdk, exported services/receivers/providers without permission, dangerous and sensitive permissions.
- **Signing**: v1/v2/v3 schemes, certificate subject, SHA-256 fingerprint, validity, key size, debug-certificate detection, Janus-vulnerable v1-only signing.
- **Build info**: Flutter, React Native, Unity, Xamarin, Cordova and Compose detection, native ABIs and libraries, DEX/class counts.

Every finding has a severity (`critical` → `info`), so you can sort and filter a batch of apps in seconds.

### Quick start

1. Click **Start**. The default input analyzes the open-source F-Droid client.
2. Replace the URL with your own APK links (`.apk`, `.xapk`, `.apks`, `.apkm` are all accepted).
3. Open the **Overview**, **Findings** or **Trackers** tab of the dataset, or export to JSON, CSV or Excel.

The link must return the file itself, not a web page with a download button.

### Input

| Field | Default | Description |
|---|---|---|
| `apkUrls` | F-Droid | Direct download URLs, one report per URL |
| `maskSecrets` | `true` | Show only the start and end of detected secrets |
| `scanAssets` | `true` | Also scan `assets/` and `res/raw/` text files and JavaScript bundles |
| `maxUrls` | `500` | Max URLs listed per report (domains are always complete) |
| `maxApkSizeMb` | `300` | Skip larger downloads |

```json
{
    "apkUrls": [{ "url": "https://f-droid.org/F-Droid.apk" }],
    "maskSecrets": true
}
```

### Real example: F-Droid

The default input is ready to run: `https://f-droid.org/F-Droid.apk`. In a completed analysis on **October 28, 2026**, the Actor returned the following results for **F-Droid 2.0.2** (`org.fdroid.fdroid`):

| Report field | Observed result |
|---|---|
| Analysis status | `ok` |
| Target SDK | 37 |
| Highest finding severity | `medium` |
| Detected tracker SDKs | 0 |
| Potential secrets | 0 |
| Dangerous permissions | 7 |
| Exported components | 10 |
| Embedded domains | 53 |

Open **Overview** for this summary and **Findings** for the evidence behind individual warnings. These are static-analysis findings, not a verdict that an app is malicious or free of vulnerabilities. The download URL points to the latest F-Droid release, so versions and results can change.

### Output (abridged)

```json
{
    "sourceUrl": "https://example.com/app.apk",
    "status": "ok",
    "packageName": "com.example.app",
    "versionName": "5.2.0",
    "targetSdk": 34,
    "summary": {
        "highestSeverity": "high",
        "severityCounts": { "critical": 0, "high": 1, "medium": 2, "low": 3, "info": 1 },
        "trackerCount": 7,
        "secretCount": 2,
        "dangerousPermissionCount": 5,
        "exportedComponentCount": 9,
        "domainCount": 64
    },
    "findings": [
        { "id": "hardcoded-secret", "severity": "high", "title": "Hardcoded Slack webhook", "detail": "Found in assets/config.json (1x): https…a1B2" }
    ],
    "trackers": [
        { "name": "AppsFlyer", "category": "attribution", "matchedClasses": 412, "evidence": "com.appsflyer.AppsFlyerLib" }
    ],
    "secrets": [ "…" ],
    "network": { "domains": [ "…" ], "urls": [ "…" ], "cleartextUrls": [ "…" ], "cloudEndpoints": [ "…" ] },
    "manifest": { "flags": { "debuggable": false, "allowBackup": true, "usesCleartextTraffic": false }, "permissions": { "…": "…" }, "exportedComponents": [ "…" ] },
    "signing": { "schemes": { "v1": false, "v2": true, "v3": true }, "certificates": [ "…" ] },
    "build": { "frameworks": ["React Native"], "nativeAbis": ["arm64-v8a"], "classCount": 53239 },
    "file": { "sha256": "…", "md5": "…", "sizeBytes": 40457062, "format": "apk" }
}
```

Failed downloads or invalid files produce an item with `"status": "error"` and a readable `error` message. **Failed items are not charged.**

### Use cases

- **Privacy & GDPR audits**: list every tracker and data-collecting SDK in an app before release or procurement.
- **Mobile pentest recon**: secrets, exported components and backend endpoints in seconds, before you open jadx.
- **Bug bounty**: triage dozens of in-scope APKs for leaked keys and open Firebase/S3 backends.
- **Vendor & third-party risk**: check the apps your company depends on.
- **Competitive research**: see which analytics, ad networks and frameworks competitors use.
- **AI agents**: one clear input, structured output, ready for MCP and agent tool calls.

### Pricing

**$0.08 per successfully analyzed APK** ($80 per 1,000). Platform usage for the analysis is included. No start fee. Failed downloads and invalid files are not charged.

| Successfully analyzed APKs | Analysis price (USD) |
|---|---:|
| 1 | $0.08 |
| 10 | $0.80 |
| 100 | $8.00 |
| 1,000 | $80.00 |

Prices above cover the analysis event. Any separate Apify charges for keeping or accessing stored results are governed by your Apify plan.

### How it works

The Actor downloads each file, unwraps split bundles, parses the binary manifest and signing blocks with Androguard, and reads DEX string tables directly. It does not decompile or execute code. Runtime depends on APK size, download speed and bundled files. A complete F-Droid demo run took about 90 seconds in our launch test; other runs can be faster or slower.

### Limitations

- Static analysis only: code that is downloaded at runtime, encrypted or heavily obfuscated strings will not be seen.
- Tracker detection uses package names; SDKs that are renamed by obfuscation may be missed.
- A detected key is not necessarily valid or exploitable. Verify findings before reporting them.

### Where to get an APK link

The input must be a direct link to the file. Typical sources:

- **Your own builds:** CI artifacts, GitHub Releases, S3 or any file host. The most common use for audits of your own apps.
- **Open-source app stores:** F-Droid and similar publish direct `.apk` links.
- **Vendor download pages** that link straight to the `.apk`, `.xapk`, `.apks` or `.apkm` file.

A link to a web page with a "Download" button will not work: the Actor tells you so in the `error` field and does not charge for it.

### Use it from code

```python
from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("bifras/apk-security-analyzer").call(
    run_input={"apkUrls": [{"url": "https://f-droid.org/F-Droid.apk"}]}
)
for report in client.dataset(run["defaultDatasetId"]).iterate_items():
    if report.get("status") != "ok":
        print("Analysis failed:", report.get("sourceUrl"), report.get("error", "Unknown error"))
        continue
    print(report["packageName"], report["summary"]["highestSeverity"])
    for finding in report["findings"]:
        print(" -", finding["severity"], finding["title"])
```

It also works with the Apify API, scheduled runs (re-check every release), webhooks, Make, Zapier and n8n. Use a webhook to fail a CI job when `summary.highestSeverity` is `high` or `critical`.

### FAQ

**Does it run the app?** No. It reads the manifest, signing block, DEX string tables and bundled assets. Nothing is executed, only parsed, and the analysis runs in an isolated Apify container.

**Why did it find no trackers in my app?** Tracker detection matches package names. Heavily obfuscated builds (renamed packages) can hide SDKs. Compare with `build.classCount` and the endpoints list.

**Is a detected secret a real leak?** Not always. Public client keys (for example Google Maps or Firebase API keys) are meant to ship in apps; the severity reflects the typical impact if the key is unrestricted. Verify before reporting.

**Are my APKs stored?** The file is downloaded for the run and analyzed in memory. Only the report is stored in your dataset.

**Can it analyze iOS apps?** Not yet. Android only.

### Responsible use

Analyze apps you own, apps you are authorized to test, or publicly distributed apps for research. Do not use detected credentials against third-party services. Report leaked secrets to the app owner.

# Actor input Schema

## `apkUrls` (type: `array`):

Direct download links to .apk files (or .xapk / .apks / .apkm split bundles). Each URL produces one report. The link must return the file itself, not a download page.

## `maskSecrets` (type: `boolean`):

Show only the first and last characters of hardcoded keys and tokens. A SHA-256 hash of the full value is always included so you can match findings without exposing them.

## `scanAssets` (type: `boolean`):

Also scan text files in assets/ and res/raw/ (config JSON, React Native / Cordova JavaScript bundles). Recommended: many keys live there rather than in DEX code.

## `maxUrls` (type: `integer`):

Cap on the number of embedded URLs listed per APK. Domains are always listed in full.

## `maxApkSizeMb` (type: `integer`):

Downloads larger than this are skipped. Very large games may need more memory.

## Actor input object example

```json
{
  "apkUrls": [
    {
      "url": "https://f-droid.org/F-Droid.apk"
    }
  ],
  "maskSecrets": true,
  "scanAssets": true,
  "maxUrls": 500,
  "maxApkSizeMb": 300
}
```

# Actor output Schema

## `overview` (type: `string`):

One row per APK with package, version, highest severity and counts of trackers, secrets, permissions and domains.

## `findings` (type: `string`):

All findings across analyzed APKs, one row per finding with severity, title and detail.

## `reports` (type: `string`):

Complete analysis report for each APK.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "apkUrls": [
        {
            "url": "https://f-droid.org/F-Droid.apk"
        }
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("bifras/apk-security-analyzer").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "apkUrls": [{ "url": "https://f-droid.org/F-Droid.apk" }] }

# Run the Actor and wait for it to finish
run = client.actor("bifras/apk-security-analyzer").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "apkUrls": [
    {
      "url": "https://f-droid.org/F-Droid.apk"
    }
  ]
}' |
apify call bifras/apk-security-analyzer --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,bifras/apk-security-analyzer"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/fHmlD28kJ6NwbxDtO/builds/o4ZwJ7fK9HrSzM2az/openapi.json