Broken API Versioning Security

Detects API endpoints that use user-supplied IDs to access objects without verifying the requesting user owns or has permission to access that object.

Detects old API versions that may lack current security controls and deprecated endpoints still accessible in production.

Detects Android Activities, Services, BroadcastReceivers, and ContentProviders exported without proper permission checks.

Detects Android intent redirection vulnerabilities where attacker-controlled intents are re-sent or forwarded, enabling privilege escalation.

Detects API endpoints that perform privileged operations without verifying the caller has the required role or permission.

Detects common OAuth 2.0 implementation mistakes including missing state parameter, open redirect in redirect_uri, and token exposure.

Detects sensitive data stored in plaintext in SharedPreferences, SQLite databases, or external storage in Android applications.

Detects insecure multi-factor authentication implementations that can be bypassed.

Detects passwords stored in plaintext or hashed with weak/unsalted algorithms instead of bcrypt/argon2/scrypt.

Detects login and authentication endpoints that lack rate limiting, account lockout, or CAPTCHA protection.

Detects cookies set without Secure, HttpOnly, or SameSite attributes.

Detects missing session regeneration after login, allowing session fixation attacks.