# dwisiswant0/apkleaks

Scanning APK file for URIs, endpoints & secrets.

Repository: https://github.com/dwisiswant0/apkleaks
Canonical: https://ross.abutalabs.com/products/apkleaks
Language: Python
License: Apache-2.0
License Family: permissive
Topics: mobile-security, android-security, reverse-engineering, bugbounty, static-analysis, apk, scanning-apk, apk-parser
Last push: 2025-08-20T21:55:15+00:00

## Health v2 (maintenance only)
Score: 39/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 37, release rhythm 8, longevity 100
- inputs: {"age_days": 2287, "days_push": 378, "days_rel": 682, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 6275, forks 588 (observed 2026-08-28T04:09:41.199388+00:00)

## What it is
APKLeaks is a Python CLI tool that decompiles Android APK files with jadx and scans them for URIs, endpoints, and hardcoded secrets using regex patterns. It supports custom pattern rules and text or JSON output.

## Use cases
- find hardcoded secrets in an android apk
- extract urls and endpoints from an apk file
- scan apk for api keys during bug bounty
- static analysis of android apps for sensitive data
- run custom regex patterns against a decompiled apk
- audit mobile app security before a pentest

## When to choose
- you need quick automated secret and endpoint discovery in APKs
- you want a lightweight CLI that fits bug bounty or pentest workflows
- you need custom detection rules via JSON patterns or JSON output for pipelines

## When to avoid
- you need dynamic analysis or runtime behavior of the app
- you target iOS or non-Android binaries
- you need decompilation without installing jadx as an external dependency

## Facets
- artifact type: cli-tool
- maturity: active
- function: reverse-engineering, vulnerability-scanning, parser, security
- domain: security, mobile-development, reverse-engineering, developer-tools
- platform: cli, python, windows, cross-platform
- tags: apk, static-analysis, secrets-detection, bugbounty, android, jadx, mobile-security, command-line, linux, macos, docker

## Member repositories
- dwisiswant0/apkleaks (main) score 39

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:41.199388+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:46:28.803970+00:00, confidence not recorded.
  - readme: https://github.com/dwisiswant0/apkleaks (fetched 2026-08-28T04:09:41.199388+00:00, sha 76031f86b1d0)
  - registry_pypi: https://pypi.org/pypi/apkleaks/json (fetched 2026-08-29T08:43:02.916354+00:00, sha e4f3ddd4e9a0)
- Data as of 2026-08-30T08:39:29.467469+00:00.