Components & app links
Exported activities, services, receivers, content providers, intents, deep links, and permission boundaries.
Android application security
Your APK.
An adversarial
perspective.
Go deeper than a list of alerts. Connect what your Android app exposes, what its code allows, and what actually happens on a device.
$100 USDOne APK. A full assessment.
Scope agreed before we begin.
Scope agreed before we begin.
LOOK CLOSER
BUILD THE CONTEXT. QUESTION THE ASSUMPTIONS.Scroll to explore
The difference is in the questions
An alert starts
an investigation.
SAST is a valuable part of the toolkit. APKHunt Agent brings static analysis into a wider Android review: app context, device behavior, attacker reachability, and a separate challenge of each finding.
STATIC ANALYSISWhat might
What might
be wrong?
Rules, data-flow analysis, and source inspection identify suspicious paths worth investigating.
THE ASSESSMENT GOES FURTHERCan it happen?
Can it happen?
Who can make it happen?
We connect the code path to an exposed entry point, observe the relevant behavior, and test what an attacker can really achieve. Tool access is never treated as proof of attacker access.
- Threat model before a checklist
- Runtime corroboration where testing is viable
- Reproduction and realistic impact before a finding
- Coverage gaps explained in the report
This describes our methodology, not a benchmark against every SAST product. No scanner or assessment can guarantee that an app is vulnerability-free.
From a build to a defensible finding
Follow the evidence.
Then challenge it.
A Claude Code–based workflow routes the review to relevant Android modules. Researcher oversight connects the stages and reviews the final conclusions.
- 01
Understand the app
Identify the build, framework, permissions, exported components, deep links, sensitive assets, and trust boundaries. Establish the threat model and agreed scope.
OUTPUT / Attack-surface map - 02
Trace the source
Inspect relevant paths with decompilation, source review, and appropriate static or taint-analysis tools. Kotlin, Flutter, React Native, and JNI need different approaches.
OUTPUT / Testable hypotheses - 03
Observe the behavior
Use device testing and Frida instrumentation when viable. First verify that instrumentation works; then trace relevant methods, storage, network flows, and IPC.
OUTPUT / Runtime observations - 04
Connect both views
Compare source paths with runtime observations. Investigate unexpected endpoints, contradictions, and dynamically loaded behavior instead of treating either view as complete.
OUTPUT / Evidence-linked leads - 05
Reproduce the impact
Test attacker prerequisites and platform protections. Use controlled reproductions and negative controls to distinguish an exploitable path from a scanner signal.
OUTPUT / Reproduction evidence - 06
Review and report
A separate triage pass challenges the evidence and severity. Researcher review turns the results into clear steps, realistic impact, remediation, and explicit limitations.
OUTPUT / Actionable assessment
Relevant depth, selected for your app
Every APK has
its own edges.
The attack surface determines the review. We select the relevant checks and record what was tested, what was not applicable, and what could not be verified.
WebViews & bridges
Navigation trust, JavaScript interfaces, origin checks, file access, and the handoff between web content and native code.
Storage & identity
Sensitive data, logging, crypto usage, tokens, authentication flows, sessions, and credential handling.
Network & API flows
Requests, transport, client trust, and app-to-server boundaries. Active backend tests require explicit inclusion in scope.
Framework & native code
Relevant Kotlin, Flutter, React Native, JNI, native library, and obfuscation paths, using tools suited to the build.
Business logic & chains
State transitions, authorization assumptions, and whether individually small issues combine into a meaningful impact.
The output should help you fix things
Evidence you
can work with.
You receive a written assessment of the agreed APK build, with enough context to understand each confirmed issue and act on it.
Tell us about your appAPKHUNT / ASSESSMENT
From observation
to remediation.
- Scope & threat modelThe APK build, attack surface, test conditions, and assumptions.
- Reproducible findingsSteps, supporting evidence, realistic impact, and severity reasoning.
- Actionable fixesRemediation tied to the affected flow or component.
- Coverage & limitationsWhat was reviewed, blocked, or left unverified. Leads stay distinct from confirmed findings.
Report contents shown here. No fabricated sample findings.
A researcher behind the workflow
Built by Mrunal Chawda.
Security researcher, open-source builder, and co-creator of APKHunt. The agent workflow builds on hands-on Android review and a habit of questioning what a system trusts.
Before you send an APK
Good questions.
Clear answers.
What does the $100 assessment cover?
A full assessment of one agreed Android APK build: attack-surface review, relevant static analysis, runtime validation where feasible, triage, and a written report. We agree the app, access, testing boundaries, timing, and payment arrangements by email before work begins. Broad infrastructure or unrelated backend testing is not implied.
How is APKHunt Agent different from a SAST-only scan?
SAST analyzes code for potentially unsafe behavior. Our workflow also models the app’s attack surface, observes runtime behavior when possible, checks whether an attacker can reach a path, and challenges findings before reporting. Static analysis remains part of the assessment; a flagged pattern alone is not a confirmed vulnerability.
Is this fully automated?
No. Agents assist analysis and evidence gathering, with a separate triage pass and researcher oversight. Mrunal reviews the assessment and its conclusions. You are requesting an assessment service, not purchasing an unattended scanner or an agent subscription.
Do you need source code or test credentials?
An APK is the starting point. Source code can help but is not required for APK analysis. Authenticated features usually need test accounts and an appropriate test environment. We arrange access separately after agreeing scope. Do not paste passwords, private keys, or production secrets into the inquiry form.
Can you review an obfuscated or protected APK?
We adapt inspection to manifest entries, bytecode signatures, native code, and runtime behavior instead of relying only on class names. Anti-tamper controls or device restrictions can still prevent some tests. We discuss feasibility and clearly state any resulting coverage limits.
Will you guarantee vulnerabilities or certify my app as secure?
No. An assessment can find no confirmed vulnerabilities and still provide useful coverage and observations. It cannot prove that every possible weakness is absent, and it is not a certification or a guarantee of compliance.
How do I share my APK, and when will I get the report?
Start with a short inquiry. We reply by email to agree the scope, arrange an APK transfer and any test access, and confirm a delivery date before starting. This form does not upload APKs, start a scan, or charge your card.
Let’s look beneath the surface
Your next build.
A closer look.
Tell us what your app does and what you want reviewed. We’ll agree the scope, arrange the APK and test access, run the assessment, and deliver the results.
$100USD / APK assessment
One agreed APK build. No charge on inquiry.
Timing and payment confirmed before work starts.