A security scan on every build you upload

Hardcoded secrets, on high confidence patterns only: AWS access key ids, Stripe live secret and restricted keys, PEM private keys, Google service account JSON, Slack tokens and webhook addresses, GitHub tokens and legacy Firebase Cloud Messaging server keys. It reads dex code, resources, assets, React Native bundles (index.android.bundle, main.jsbundle), Info.plist, the iOS main binary and Flutter compiled code. Google API keys are a note, not an error: they are meant to ship, and the fix is to restrict them to your app. Sample values such as keys with EXAMPLE in them are skipped.

Android: app data backed up without rules (allowBackup on or not set, with no dataExtractionRules or fullBackupContent), activities, services, receivers and providers exported without a permission (the launcher activity is left out), user added certificates trusted outside debug-overrides, a debuggable build, plain HTTP for every server, WebView debugging referenced in the code, a minimum API below 24, and a hint when class names in classes.dex look unshrunk, which usually means R8 did not run.

iOS: App Transport Security turned off for every domain, each exception domain with what it loosens, insecure loads allowed in web views, local symbols left in the binary, and get-task-allow in a build that is not development signed.

Libraries: a short dated table of versions with a public advisory (OkHttp, Play Core, OpenSSL, zlib and AFNetworking, checked November 8, 2026). A version is matched only when the build states it; it is never guessed.

Integrity checks: whether the app ships root, jailbreak, tamper or attestation checks such as RootBeer, freeRASP, Play Integrity, Firebase App Check, App Attest or IOSSecuritySuite. This is a note either way, because most apps do not need one.

Every finding has a level (to fix, warning or note) and an OWASP MASVS category: storage, cryptography, network, platform, code or resilience. The result is a count such as "1 to fix, 3 warnings". There is no percentage and no grade, because a single leaked key matters more than ten notes.

Free shows the counts on every build, so you know when there is something to look at. Pro and Team show every finding with where it is and how to fix it, the AI fix plan, the CLI command and the MCP tool get_security_scan for your AI coding assistant.

Team adds the full report grouped by MASVS category, an export as JSON or a printable page to send to a client or keep in an audit folder, and the history of findings across the builds of one app, with what is new and what was fixed since the build before.

appforshare security <build> prints the findings. Add --fail-on block to fail the job when something has to be fixed, or --fail-on warn to fail on warnings too; both exit with code 2 and leave the build uploaded. On Team, --format json or html saves the full report as a file. The CI build answer carries the counts as security on every plan, and GET /api/ci/builds/{ref}/security returns the findings.

Dedicated mobile application security testing tools go further: they run the app, watch its traffic, trace data through the code and, in some products, add obfuscation and runtime protection when the app is built. They are usually bought by security teams and priced per app. If you handle payments, health data or banking, you likely need one, plus a manual test.

The AppForShare scan is the other end: a static read of the file you already upload, on every build, included in the plan you have. It catches the common, costly mistakes early and gives you a record per build. It does not replace a penetration test.