Security scan

Both platforms

Secrets are matched on high confidence patterns only, in dex code, resources, assets, React Native bundles, Info.plist, the iOS main binary and Flutter compiled code. A library version is matched only when the build states it; it is never guessed. The advisory table was checked on November 8, 2026, and every entry links its public advisory.

Android

iOS

What each plan shows

Free

The counts on every build ("1 to fix, 3 warnings, 2 notes") with a locked preview of the findings. The CI build answer carries the counts.

Pro

Every finding with its file, detail and fix; an AI fix plan (1 AI action, cached for the same build); appforshare security with --fail-on; the MCP tool get_security_scan; GET /api/ci/builds/{ref}/security.

Team

Everything in Pro, plus the full report grouped by MASVS category, export as JSON or a printable HTML page (dashboard, CLI --format, CI API), and the findings history across the builds of one app with what is new and what was fixed since the build before.

Plans and prices: pricing.

CLI

CLI 1.22.0 or later, with an API token from Dashboard, Settings (Pro and Team). --fail-on block exits with code 2 when the build has something to fix; --fail-on warn also on warnings. The build stays uploaded either way. A build that was not scanned never fails the gate.

# Print the findings of a build (id or slug)
npx appforshare security 12345

# Fail the job when something has to be fixed (exit code 2)
npx appforshare security 12345 --fail-on block

# Fail on warnings too
npx appforshare security 12345 --fail-on warn

# Machine readable
npx appforshare security 12345 --json

# Team: the full report as a file
npx appforshare security 12345 --format html --out security-report.html
npx appforshare security 12345 --format json --out security-report.json

What it prints (shortened):

Shop 3.2.0 (88)
Security scan: 1 to fix, 2 warnings, 1 note
  TO FIX [MASVS-STORAGE] Stripe live secret key in the build
      Found in assets/config.json (sk_l...9Qx2). ...
      Fix: ...
  WARN   [MASVS-STORAGE] App data is backed up (allowBackup on)
  WARN   [MASVS-PLATFORM] 2 exported components without a permission
  NOTE   [MASVS-RESILIENCE] No root or tamper detection found
  14 checks without findings.
Findings and hints from a static scan of the file, not a penetration test or a certification.

GitHub Actions

Upload with the GitHub Action, then gate on the scan with the CLI in the next step. Testers still get the link; the job fails so the team sees the finding.

- name: Share build
  id: share
  uses: appforshare/appforshare-action@v1
  with:
    token: ${{ secrets.APPFORSHARE_TOKEN }}
    file: app/build/outputs/apk/release/app-release.apk

- name: Security scan gate
  run: npx appforshare@latest security ${{ steps.share.outputs.slug }} --fail-on block
  env:
    APPFORSHARE_TOKEN: ${{ secrets.APPFORSHARE_TOKEN }}

CI API

GET /api/ci/builds/{ref} carries security with status, summary and counts on every plan. GET /api/ci/builds/{ref}/security returns the findings (Pro and Team), and /security/export?format=json or html the full report (Team). status is unknown for builds that were not scanned. Full reference: CI API.

GET https://appforshare.io/api/ci/builds/12345/security
Authorization: Bearer $APPFORSHARE_TOKEN

{
  "status": "scanned",
  "summary": "1 to fix, 2 warnings, 1 note",
  "counts": { "block": 1, "warn": 2, "info": 1 },
  "groups": [{ "masvs": "MASVS-STORAGE", "title": "Storage: ...", "counts": { ... } }],
  "capped": false,
  "findings": [{ "id": "sec.secret.stripe-live-secret", "level": "block", "masvs": "MASVS-STORAGE", "title": "...", "detail": "...", "fix": "..." }],
  "passed": ["..."]
}

MCP server

The read only tool get_security_scan returns the same findings to Claude, Cursor, Codex, VS Code or ChatGPT (MCP 1.0.9, Pro and Team). Ask "what did the security scan find in the newest Android build?" and the assistant can open the files it names in your repository. Setup: MCP server.