{
  "exampleType": "redacted retained native report excerpt",
  "sourceReportSha256": "3739fbb18d5ba20dafa4d187b3d856637d43f5a6c6cddb14c9aac3e7f33d4da4",
  "redactions": [
    "input paths",
    "output paths",
    "raw evidence locations and text",
    "nonselected findings"
  ],
  "fixture": "ASL-owned X-Ray Lite APK",
  "notCurrentReleaseAttestation": true,
  "schemaVersion": "1.0",
  "engineVersion": "1.0.10.0",
  "ruleSetVersion": "asl-apk-audit-rules/2.1",
  "scoringVersion": "asl-apk-risk-score/1.1",
  "analysisMode": "offline-static",
  "generatedUtc": "2026-09-07T19:07:07.8201093+00:00",
  "appIdentity": {
    "packageName": "com.autosecurelogin.apksecurity.lite",
    "label": "ASL X-Ray Lite",
    "versionName": null,
    "minSdk": null,
    "targetSdk": null,
    "debuggable": null,
    "usesCleartextTraffic": false,
    "permissions": [
      "com.autosecurelogin.apksecurity.lite.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
    ],
    "components": [
      "activity:com.autosecurelogin.apksecurity.MainActivity; exported=true",
      "provider:androidx.startup.InitializationProvider; exported=false",
      "receiver:androidx.profileinstaller.ProfileInstallReceiver; exported=true; permission=android.permission.DUMP"
    ]
  },
  "coverage": {
    "status": "Partial — observed risk only",
    "isPartial": true,
    "source": "APK decompiled locally with the bundled engines",
    "decompilerOutcomes": [
      {
        "engineId": "jadx",
        "engineName": "JADX — Java source + resources",
        "status": "Success",
        "exitCode": 0,
        "detail": "Completed successfully and produced 303 validated files.",
        "relativeOutput": "decompiled/jadx"
      },
      {
        "engineId": "apktool",
        "engineName": "apktool — resources + smali",
        "status": "Success",
        "exitCode": 0,
        "detail": "Completed successfully and produced 310 validated files.",
        "relativeOutput": "decompiled/apktool"
      },
      {
        "engineId": "extract",
        "engineName": "Built-in package extraction",
        "status": "Success",
        "exitCode": 0,
        "detail": "Completed successfully and produced 45 validated files.",
        "relativeOutput": "decompiled/extracted"
      }
    ],
    "warnings": []
  },
  "riskAssessment": {
    "score": 4,
    "band": "INCONCLUSIVE",
    "verdict": "No strong indicators were observed, but incomplete coverage prevents a low-risk conclusion.",
    "likelyPurpose": "ASL X-Ray Lite has no confirmed sensitive capability from these rules in the scanned coverage. Review individual findings and coverage limits; this is not a safety guarantee.",
    "findingCount": 13,
    "scoredFindingCount": 1,
    "criticalCorrelationCount": 0
  },
  "limitations": [
    "Skipped 9 files with text-like extensions because they decoded as binary content."
  ],
  "inputSha256": "C087FB70F96B9E8640CD7493964A603AFBB0134ADEA2BB0E15EFB9779DFCF31B",
  "findings": [
    {
      "ruleId": "ASL-APK-IMPACT-FILE-DELETE-001",
      "category": "Impact",
      "severity": "Medium",
      "confidence": "Medium",
      "title": "File deletion or destructive traversal",
      "summary": "Code references recursive file handling and deletion operations.",
      "whyItMatters": "Bulk deletion or replacement can damage user data when combined with coercive or encryption behavior.",
      "recommendation": "Review targeted directories, recursion boundaries, and recovery safeguards.",
      "rawScore": 6,
      "adjustedScore": 4
    },
    {
      "ruleId": "ASL-APK-COLLECT-AUDIO-001",
      "category": "ReferenceOnly",
      "severity": "Informational",
      "confidence": "Low",
      "title": "Unconfirmed reference: Microphone capture",
      "summary": "Names or text matched this rule without a corresponding executable API reference or relevant manifest declaration. These references are retained for review but do not establish the behavior or contribute to a malware chain. Reflection, dynamic code and string-built behavior need separate investigation.",
      "whyItMatters": "Unclear background microphone use can support surveillance.",
      "recommendation": "Trace all recording entry points and require clear, active user consent.",
      "rawScore": 0,
      "adjustedScore": 0
    },
    {
      "ruleId": "ASL-APK-COLLECT-LOCATION-001",
      "category": "ReferenceOnly",
      "severity": "Informational",
      "confidence": "Low",
      "title": "Unconfirmed reference: Location collection",
      "summary": "Names or text matched this rule without a corresponding executable API reference or relevant manifest declaration. These references are retained for review but do not establish the behavior or contribute to a malware chain. Reflection, dynamic code and string-built behavior need separate investigation.",
      "whyItMatters": "Location can enable physical tracking when collected persistently or sent remotely.",
      "recommendation": "Confirm collection frequency, retention, disclosure, and network destinations.",
      "rawScore": 0,
      "adjustedScore": 0
    }
  ]
}