Android Insecure Data Storage

Detects API endpoints that perform privileged operations without verifying the caller has the required role or permission.

Detects old API versions that may lack current security controls and deprecated endpoints still accessible in production.

Detects Android Activities, Services, BroadcastReceivers, and ContentProviders exported without proper permission checks.

Detects API endpoints that use user-supplied IDs to access objects without verifying the requesting user owns or has permission to access that object.

Detects common OAuth 2.0 implementation mistakes including missing state parameter, open redirect in redirect_uri, and token exposure.

Detects Android intent redirection vulnerabilities where attacker-controlled intents are re-sent or forwarded, enabling privilege escalation.

Detects passwords stored in plaintext or hashed with weak/unsalted algorithms instead of bcrypt/argon2/scrypt.

Detects missing session regeneration after login, allowing session fixation attacks.

Detects cookies set without Secure, HttpOnly, or SameSite attributes.

Detects login and authentication endpoints that lack rate limiting, account lockout, or CAPTCHA protection.

Detects insecure multi-factor authentication implementations that can be bypassed.

Detects authentication and registration endpoints that reveal whether a username or email exists, enabling targeted attacks.