Security scan report
Automated mobile-security self-assessment · 23 August 2026 · app version 1.0.25
Free, open-source scanners were run against RefundRadar's app, worker, and extension source. Zero hardcoded secrets in the shipped code; zero real vulnerabilities. Every tool finding was triaged to a false positive, a platform-level mitigation, or an accepted informational item — all documented below so anyone can reproduce it.
This is an honest self-assessment against the OWASP MASVS — not an OWASP-issued certification (OWASP does not certify apps).
Reproduce it yourself
Everything here is from free, open-source tools. To repeat the source + secret scan on a clone of the app:
# static analysis, MASVS-mapped (Python)
pip install mobsfscan==1.0.0
mobsfscan android/app/src ios/RefundRadar
# secret scan (config allowlists test fixtures + docs)
brew install gitleaks # v8.30.1
gitleaks dir . --config .gitleaks.tomlThe full APK/IPA (binary) analysis uses MobSF against a signed build; the source-level results above are the reproducible baseline.
Findings & remediation
| Finding | Tool | Status | Detail |
|---|---|---|---|
| Hardcoded secrets | gitleaks 8.30.1 | 0 found | No API keys, tokens, or credentials in the app, worker, or extension source. (Throwaway test fixtures and example keys quoted in internal docs are allowlisted in .gitleaks.toml.) |
| iOS — App Transport Security disabled | mobsfscan | False positive | Matched a vendored build tool (terminal-notifier) in the fastlane gem cache, not the app. The app sets NSAllowsArbitraryLoads: false with a scoped temu.com exception. ATS is on. |
| Android — StrandHogg 2.0 task hijacking | mobsfscan | Platform-mitigated | Fixed at the OS level for targetSdk ≥ 29; the app targets SDK 36. (The scanner reads the manifest statically and can't see the Gradle target.) |
| Android — minSdk 24 | mobsfscan | Not a vuln | A deliberate device-reach choice, not a vulnerability. |
| Optional hardening not implemented (cert pinning, root detection, tapjacking/screenshot prevention, Play Integrity) | mobsfscan | Informational | Standard optional defences; none is a vulnerability. Candidates for future hardening if the threat model warrants. |
Controls we verified in the source
- Credentials encrypted at rest — Android
EncryptedSharedPreferences(AES-256, Keystore master key); iOS Keychain. - Temu session isolation — the Temu login lives in the on-device WebView cookie jar and is used only for requests to Temu. It is never sent to RefundRadar's servers.
- On-device processing — price checks and claims run on the device, directly with Temu; detecting a drop and filing a claim require nothing on our servers.
- Transport security — ATS enabled on iOS; traffic to our API is HTTPS-only; the bearer token is redacted from logs.
- No third-party tracking — no Amplitude, Segment, Google Analytics, Facebook, AppsFlyer, Adjust or Sentry SDKs. Analytics is first-party only.
Permissions requested
Android
INTERNET— talk to Temu and our APIPOST_NOTIFICATIONS— tell you when credit landsFOREGROUND_SERVICE_DATA_SYNC— run a background price scan
No location, contacts, storage, camera, microphone, or phone permissions.
iOS
No sensitive-permission usage strings are declared (no location, contacts, photos, camera, or microphone). The app uses push notifications only.
Third-party dependencies
iOS
KeychainAccess (secure token storage) — the only third-party Swift package. Push uses Apple's native frameworks.
Android
AndroidX (Jetpack Compose, Navigation, Lifecycle, DataStore, Room, WorkManager, Browser), AndroidX Security-Crypto (token encryption), Hilt (DI), Kotlin Coroutines & Serialization, OkHttp 4.12.0 / Retrofit 2.11.0 (networking), Coil (images), Timber (logging), Play Review, and Firebase Cloud Messaging + Installations (push).
No advertising or third-party analytics/tracking SDKs on either platform.
Build integrity
RefundRadar is distributed only through the official App Store and Google Play
(Android package co.refundradar, iOS App ID 6778789358) —
never as a sideloaded APK from third-party sites.
On Android, Google Play Automatic Protection is enabled — it blocks unofficial or tampered redistribution of the app — and every install is signed by Google through Play App Signing. Over the last 30 days, 100% of installs came through Google Play with no unknown redistribution. In short, the copy you install from the store is the genuine, unmodified app.
Advanced users can confirm their install's signing certificate with
apksigner verify --print-certs; the full fingerprint is available on request at
hello@refundradar.co.
Report a vulnerability
See our security.txt or email hello@refundradar.co. We don't take legal action against good-faith security research. Back to the Security overview.