APKscan Android APK Secrets and Endpoint Security Scanner

APKscan is an Android application security scanner that searches decompiled application files for exposed secrets, backend endpoints, and other sensitive information. Developers sometimes leave API keys, access tokens, credentials, and internal service URLs inside compiled applications, assuming that compilation or code obfuscation will keep them hidden.

APKscan automates this review by combining decompilation, optional deobfuscation, and configurable detection rules. Security researchers and Android developers can use it to audit applications they own or are authorized to assess, identify potential exposures, and prioritize fixes before release.

Why Use APKscan for Android Security Analysis?

Android packages may contain hardcoded credentials, development endpoints, test payloads, and references to internal services. APKscan searches for these indicators in reconstructed source code and related application files, helping developers find information that should not ship with a production app.

The tool can also help locate code associated with security controls, such as SSL pinning and root detection. This information supports authorized security reviews and helps developers assess whether their protections are implemented correctly.

For source repositories and development pipelines, tools such as Gitleaks for detecting exposed secrets provide a complementary way to identify leaked credentials before they reach a deployed application. APKscan focuses on Android-related files that may need decompilation first.

Key Features of APKscan

• Automated secret detection: Scan one or multiple files for API keys, tokens, credentials, and other sensitive patterns.
• Backend endpoint discovery: Identify embedded URLs, forgotten test endpoints, and references to backend services.
• Multiple decompilers: Supports JADX, APKTool, CFR, Procyon, Krakatau, and Fernflower.
• Custom detection rules: Accepts SecretLocator JSON, secret-patterns-db YAML, Gitleaks TOML, and simple key-value patterns.
• Multiple output formats: Export results as text, JSON, or YAML, grouped by input file, matched locator, or both.
• Broad file support: Works with formats such as APK, XAPK, DEX, JAR, CLASS, SMALI, ZIP, AAR, ARSC, AAB, and JADX KTS files.
• Concurrency controls: Configure worker counts, processing methods, chunk sizes, and timeouts for larger scans.

APKscan uses Enjarify to convert Dalvik bytecode to Java bytecode when needed by supported decompilers. Its default decompiler is JADX, while alternative decompilers can improve coverage when one tool produces incomplete or difficult-to-read output.

For another approach to finding exposed credentials, see TruffleHog for secret scanning.

How to Install APKscan on Linux

APKscan is available through Python’s package manager. Use a virtual environment to keep its Python dependencies separate from system packages.

python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install apkscan

You can also install the project from its source repository:

git clone https://github.com/LucasFaudman/apkscan.git
cd apkscan
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -e .

Review the official APKscan repository for current installation requirements, supported options, and dependency updates.

Scan APK Files for Secrets and Endpoints

Run the scanner against an application file with its default decompiler and detection rules:

apkscan app-to-scan.apk

To focus on AWS-related patterns and endpoint references, select the corresponding built-in locator sets:

apkscan app-to-scan.apk -r aws endpoints

For larger audits, scan multiple packages and save the results in YAML format:

apkscan -r /path/to/custom/rules.json \
  -o findings.yaml \
  -f yaml \
  -g locator \
  -c app1.apk app2.apk

The -f yaml option selects YAML output, while -g locator groups findings by the rule that matched. The -c option removes generated decompilation directories after scanning, so omit it if you need those files for manual review.

Configure Decompilers and Scan Rules

APKscan defaults to JADX, but you can select additional decompilers when auditing applications with complex or obfuscated code. For example, the following command uses both JADX and APKTool:

apkscan --jadx --apktool app-to-scan.apk

Custom rules let teams detect organization-specific tokens, service URLs, and credential formats. Before relying on a rule, validate its pattern against test data and review matches manually. Broad regular expressions can produce false positives, while incomplete patterns may miss exposed secrets.

APKscan also supports separate concurrency settings for decompilation and secret scanning. Tune worker counts and timeouts according to available CPU and memory, especially when analyzing large APK collections or enabling several decompilers.

For the complete list of supported arguments, rule formats, and configuration examples, consult the APKscan project documentation.