01
High
Release build is debuggable
app/build.gradle.kts:10Debug interfaces and inspection behavior do not belong in a production artifact.
Founding audit: 3 slots
ShipSentry
Android release risks, surfaced before your users find them.
Local-only scan / zero dependencies / no source upload
8risk classes
< 30 sectypical local scan
0files uploaded
MITLite scanner license
Actual sample output
Evidence, not a green checkmark.
ShipSentry Lite points to the file and line that deserve review. The sample project ships with the repo, so every finding is reproducible.
02
High
Cleartext traffic is enabled
AndroidManifest.xml:2Unencrypted traffic expands interception risk and can hide environment-specific mistakes.
03
Medium
JavaScript bridge exposed
MainActivity.kt:10WebView bridges need narrow interfaces, trusted content, and deliberate navigation controls.
Free in under a minute
Run it where the code lives.
Terminal
curl -fsSLO https://raw.githubusercontent.com/adamglin0/shipsentry/main/scan.sh
chmod +x scan.sh
./scan.sh /path/to/android-project shipsentry-report.mdGitHub Actions
uses: adamglin0/shipsentry@v0.2.01
Download one readable Bash script.
2
Scan locally. Nothing leaves the machine.
3
Review a portable Markdown report.
Founding offer
A scanner finds patterns. A review finds release risk.
For one Android app module up to 30,000 source lines: prioritized findings, file-level evidence, fix guidance, and one clarification round.
- Gradle and manifest release configuration
- Network security, WebView, secrets, logs, and backups
- R8 readiness and release hygiene
- Target: three business days after access is confirmed
Founding price39 USDT
TRON network (TRC20)
TSg3cFixQzkczF9BJ5DqHCnE3AP3AjRhgiAudit payment: submit a request and wait for scope acceptance before paying. Send USDT only on TRON (TRC20).
Using Lite? Optional tips to the same address are welcome. A tip does not purchase a service or reserve an audit slot.
Request an audit