Every upload is checked for known malware

ClamAV, the open source antivirus engine, reads the uploaded package with archive scanning on, so the files inside an .apk or .ipa are checked, not only the outer zip. For an .aab, the APK made from it is checked. ClamAV reads files up to 2 GiB.

MalwareBazaar is a public database of malware samples run by abuse.ch. We send it the SHA-256 hash of the file, and of the original upload when we converted it, and it answers whether that exact file is a known sample. The file itself is never sent.

Live builds under 72 hours old are checked again once a day with the newest signatures, because new malware is added to both every day.

A held build keeps its link, but the install page shows "Held for review" in the tester's language and takes no installs. Channels skip it. The file is kept so staff can look at it, and nothing is deleted automatically.

Staff get an alert at once. The owner of an account build gets one email naming the signature that matched; a guest upload shows the hold on its manage page. If you think it is a mistake, reply to the email or write to [email protected].

A person decides every hold. Released builds work again; a build released after a match is not held again for the same signature. Removed builds stay removed, and the same file cannot be uploaded again.

The build page shows the date of the last check. The CI API carries malwareScan with a status (pending, clean, flagged, error or skipped) and the time of the check on every build, appforshare info prints it, and the MCP tools list_builds and build_info return it to your AI coding assistant.

The malware check looks for files that are already known to be malicious. It protects testers and the service. The Security scan reads your own build for mistakes, such as a key left in the code or a risky setting, and tells you how to fix them. AppForShare runs both on every upload; the Security scan findings are on Pro and Team.