Auto Secure LoginASL X-Ray APK Report Example
Read a real, redacted ASL X-Ray report excerpt with an inconclusive verdict, partial coverage and explained findings from an ASL-owned Android APK.
Updated October 2, 2026
Source and scope
This excerpt comes from a retained native report dated September 7, 2026. It analyzed ASL’s own X-Ray Lite APK with engine 1.0.10.0 in offline static mode. It is a historical reading example, not a test of the current release or a customer assessment.
Native result: inconclusive
Observed score: 4; band: INCONCLUSIVE; 13 findings, one scored. Partial coverage prevents a low-risk conclusion. Nine files with text-like extensions were skipped because they decoded as binary content.
A low number must not become a safety guarantee. Static analysis does not prove what happens when the app runs and may not cover dynamic code, reflection or server-dependent behavior.
Three selected findings
| Finding | Severity | Observation | Proposed review |
|---|---|---|---|
| File deletion or destructive traversal | Medium | Code references recursive file handling and deletion operations. | Review targeted directories, recursion boundaries, and recovery safeguards. |
| Unconfirmed reference: Microphone capture | Informational | Names or text matched this rule without a corresponding executable API reference or relevant manifest declaration. These references are retained for review but do not establish the behavior or contribute to a malware chain. Reflection, dynamic code and string-built behavior need separate investigation. | Trace all recording entry points and require clear, active user consent. |
| Unconfirmed reference: Location collection | Informational | Names or text matched this rule without a corresponding executable API reference or relevant manifest declaration. These references are retained for review but do not establish the behavior or contribute to a malware chain. Reflection, dynamic code and string-built behavior need separate investigation. | Confirm collection frequency, retention, disclosure, and network destinations. |
An unconfirmed reference preserves something to review; it does not establish microphone or location access. The deletion finding calls for checking directories and boundaries, without proving malware on its own.
What the excerpt preserves
The JSON preserves versions, date, observed identity, coverage, score and three findings. Internal paths, raw evidence and the remaining findings are excluded. The original report hash identifies the source; this excerpt does not replace the full report.