Which plans include the malware check?

Every plan, and uploads without an account too. It is part of the platform, so there is nothing to turn on or pay for.

Is my file sent to another company?

No. ClamAV runs on our servers. Only the SHA-256 hash of the file is sent to MalwareBazaar (abuse.ch) to ask whether it is a known sample.

Does the check slow down my upload?

No. The install link is issued first, and the check runs right after it.

Why is malwareScan null on an older build?

The check started on November 9, 2026. Builds uploaded before that have no result. Live builds keep working as before.

Can I lift a hold myself?

No. A person at AppForShare releases or removes every held build. If you think a match is wrong, reply to the email or write to support@appforshare.io.

How is this different from the Security scan?

The malware check looks for files already known to be malicious and protects testers. The Security scan reads your own build for mistakes such as a hardcoded key and tells you how to fix them.

AppForShare Open dashboard

Docs

Malware check

Every build uploaded to AppForShare, on every plan and from guests too, is checked for known malware right after its link is issued. The upload is never slowed down. A match holds the build for a person to review. There is nothing to turn on.

What runs

ClamAV reads the uploaded package with archive scanning on. An .apk or .ipa is a zip archive, so the files inside are checked against ClamAV's signatures. For an .aab, the APK made from it is checked. ClamAV reads files up to 2 GiB; larger files get the hash lookup only.
MalwareBazaar by abuse.ch is asked about the SHA-256 hash of the file, and of the original upload when we converted it (an .aab or a zipped .app). Only the hash leaves our servers, never the file.
Live builds under 72 hours old are checked again once a day with the newest signatures.

When a check matches

The build is held: the link stays, but the install page shows "Held for review" in the tester's language and takes no installs. Channels skip it.
Our staff are alerted at once. The owner of an account build gets one email naming the signature that matched. A guest upload shows the hold on its manage page.
The file is kept for review. Nothing is deleted automatically.
A person releases the build, so the link works again, or removes it. A removed file cannot be uploaded again.

Held by mistake? Reply to the email or write to [email protected]. See also what to do if your build is held for review.

Status values

pending: The check has not run yet. It starts right after the link is issued, usually within seconds.
clean: No known malware matched. The build page shows the date of the check.
flagged: A ClamAV signature or a MalwareBazaar sample matched. The build is held for review until a person releases or removes it. A build staff released keeps this status, with the release on record.
error: An engine could not run. The build stays live, staff see it, and the check runs again within a day.
skipped: ClamAV could not read the whole file, for example a file over 2 GiB or one that hit the time limit. The hash lookup still ran.

Dashboard, CLI, CI API and MCP

The build page shows the date of a clean check, and a held build shows the hold. The CI API answers for a build and for the build list carry malwareScan with status and scannedAt (null for builds uploaded before November 9, 2026). appforshare info prints one line about it, and the MCP tools list_builds and build_info return it to your AI coding assistant. Full reference: CI API.

GET https://appforshare.io/api/ci/builds/12345
Authorization: Bearer $APPFORSHARE_TOKEN

{
  "id": 12345,
  "slug": "AbC123",
  ...
  "malwareScan": { "status": "clean", "scannedAt": "2026-11-09T10:12:04.000Z" }
}

npx appforshare info 12345
Shop 3.2.0 (88)
android  com.acme.shop  48.2 MB  14 installs
Link: https://appforshare.io/i/AbC123
Known malware check: no known malware found on 2026-11-09

What it covers

The check finds malware that is already known: a ClamAV signature or a MalwareBazaar sample. Most known mobile malware targets Android, so there are fewer signatures for iOS apps. Reports from testers and the other upload rules cover the rest; see how reports work.

Questions

Which plans include the malware check?: Every plan, and uploads without an account too. It is part of the platform, so there is nothing to turn on or pay for.
Is my file sent to another company?: No. ClamAV runs on our servers. Only the SHA-256 hash of the file is sent to MalwareBazaar (abuse.ch) to ask whether it is a known sample.
Does the check slow down my upload?: No. The install link is issued first, and the check runs right after it.
Why is malwareScan null on an older build?: The check started on November 9, 2026. Builds uploaded before that have no result. Live builds keep working as before.
Can I lift a hold myself?: No. A person at AppForShare releases or removes every held build. If you think a match is wrong, reply to the email or write to [email protected].
How is this different from the Security scan?: The malware check looks for files already known to be malicious and protects testers. The Security scan reads your own build for mistakes such as a hardcoded key and tells you how to fix them.

Overview: malware check on every upload. Related: Security scan, privacy.