← Back to resume

APK Scanner

Upload an Android package for a readable static analysis report — permissions, manifest flags, signing certificate, and hardcoded-secret heuristics. Also designed as a machine API for CI pipelines.

Static analysis CI-ready API (soon) Landing live on Pages

Drop an APK here or choose a file

UI ready · analysis API deploys next on a container host

Backend next: The FastAPI scanner cannot run natively on Cloudflare Pages. This landing ships with the resume site now. The scan API will be deployed to a container host (Workers Containers, Fly.io, or similar) and proxied here — then upload + /api/v1/scan go live.

What it checks

  • Exported components, debuggable, backup, cleartext
  • Permission risk labels
  • Hardcoded key / token patterns
  • Signing certificate (debug vs release)

Pipeline usage (coming)

curl -F apk=@app-release.apk \
  https://matthewrains.com/apk-scanner/api/v1/scan

Source

  • Python FastAPI orchestrator
  • Static scanners under /workspace/apk-scanner/
  • APK binaries deleted after scanning