Security scan report

Automated mobile-security self-assessment · 1 October 2026 (quarterly re-scan) · app version 1.0.36

This is an honest self-assessment against the OWASP MASVS — not an OWASP-issued certification (OWASP does not certify apps).

Reproduce it yourself

Everything here is from free, open-source tools. To repeat the source + secret scan on a clone of the app:

# static analysis, MASVS-mapped (Python)
pip install mobsfscan==1.0.1
mobsfscan android/app/src ios/RefundRadar

# secret scan (config allowlists test fixtures + docs)
brew install gitleaks   # v8.30.1
gitleaks dir . --config .gitleaks.toml

The full APK/IPA (binary) analysis uses MobSF against a signed build; the source-level results above are the reproducible baseline.

Findings & remediation

Finding	Tool	Status	Detail
Hardcoded secrets	gitleaks 8.30.1	0 found	No API keys, tokens, or credentials in the app, worker, or extension source. The raw scan flagged 3 strings, all triaged as non-secrets: our IndexNow key (public by design — it is served from our own website to prove site ownership) and an SQL column name in an internal query. (Throwaway test fixtures, example keys quoted in internal docs, and the public IndexNow key are allowlisted in .gitleaks.toml.)
Android — WebView remote debugging enabled	mobsfscan	Debug builds only	The call is guarded by if (BuildConfig.DEBUG), so it never runs in the store build. Remote debugging is off in the app you install.
Android — hardcoded sensitive information	mobsfscan	False positive	Matched constants named KEY that hold local preference key names (e.g. "ever_onboarded") — not passwords, tokens, or keys.
Android — raw SQL queries	mobsfscan	Not injectable	Every hit is a fixed-text database schema migration (ALTER TABLE / CREATE TABLE). None includes user input, so SQL injection is not possible; app queries go through Room's parameterised DAOs.
Android — StrandHogg 2.0 task hijacking	mobsfscan	Platform-mitigated	Fixed at the OS level for targetSdk ≥ 29; the app targets SDK 36. (The scanner reads the manifest statically and can't see the Gradle target.)
Optional hardening not implemented (cert pinning, root detection, tapjacking/screenshot prevention, Play Integrity)	mobsfscan	Informational	Standard optional defences; none is a vulnerability. Candidates for future hardening if the threat model warrants.

Controls we verified in the source

• Credentials encrypted at rest — Android EncryptedSharedPreferences (AES-256, Keystore master key); iOS Keychain.
• Temu session isolation — the Temu login lives in the on-device WebView cookie jar and is used only for requests to Temu. It is never sent to RefundRadar's servers.
• On-device processing — price checks and claims run on the device, directly with Temu; detecting a drop and filing a claim require nothing on our servers.
• Transport security — ATS enabled on iOS; traffic to our API is HTTPS-only; the bearer token is redacted from logs.
• No third-party tracking — no Amplitude, Segment, Google Analytics, Facebook, AppsFlyer, Adjust or Sentry SDKs. Analytics is first-party only.

Permissions requested

Android

• INTERNET — talk to Temu and our API
• POST_NOTIFICATIONS — tell you when credit lands
• FOREGROUND_SERVICE_DATA_SYNC — run a background price scan
• RECEIVE_BOOT_COMPLETED — re-schedule the background price scan after the phone restarts

No location, contacts, storage, camera, microphone, or phone permissions.

iOS

No sensitive-permission usage strings are declared (no location, contacts, photos, camera, or microphone). The app uses push notifications only.

Third-party dependencies

iOS

KeychainAccess (secure token storage) — the only third-party Swift package. Push uses Apple's native frameworks.

Android

AndroidX (Jetpack Compose, Navigation, Lifecycle, DataStore, Room, WorkManager, Browser), AndroidX Security-Crypto (token encryption), Hilt (DI), Kotlin Coroutines & Serialization, OkHttp 4.12.0 / Retrofit 2.11.0 (networking), Coil (images), Timber (logging), Play Review, and Firebase Cloud Messaging + Installations (push).

No advertising or third-party analytics/tracking SDKs on either platform.

Build integrity

RefundRadar is distributed only through the official App Store and Google Play (Android package co.refundradar, iOS App ID 6778789358) — never as a sideloaded APK from third-party sites.

On Android, Google Play Automatic Protection is enabled — it blocks unofficial or tampered redistribution of the app — and every install is signed by Google through Play App Signing. Over the last 30 days, 100% of installs came through Google Play with no unknown redistribution. In short, the copy you install from the store is the genuine, unmodified app.

Advanced users can confirm their install's signing certificate with apksigner verify --print-certs; the full fingerprint is available on request at hello@refundradar.co.

Report a vulnerability

See our security.txt or email hello@refundradar.co. We don't take legal action against good-faith security research. Back to the Security overview.