sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ONB-11 · Mobile (Android/iOS) onboarding specifics (APK/AAB/IPA) #129

New Issue
Open
opened 2026-07-10 08:34:46 +00:00 by sharang · 0 comments
sharang commented 2026-07-10 08:34:46 +00:00
Owner
Copy Link
Copy Source

Part of #118.

Context

Android and iOS apps need package ingest (APK/AAB/IPA) and mobile-specific static/dynamic tooling.

Scope

  • Ingest + validate APK/AAB (Android) and IPA (iOS) packages; extract manifest, permissions, embedded libs for SBOM/CVE.
  • SAST for mobile source (git/zip) + package static analysis (e.g. MobSF-class checks) — evaluate tooling.
  • DAST/dynamic: define feasibility per platform (Android emulator-based dynamic possible; iOS dynamic needs a device — mark limited).
  • Surface mobile-specific findings (insecure storage, exported components, ATS/cleartext).

Acceptance criteria

  • APK and IPA fixtures ingest with manifest + permission extraction.
  • SBOM/CVE produced from bundled libraries.
  • Applicable-scan matrix reflects iOS dynamic = limited.

Depends on

ONB-02, ONB-03, ONB-04.

Part of #118. ## Context Android and iOS apps need package ingest (APK/AAB/IPA) and mobile-specific static/dynamic tooling. ## Scope - Ingest + validate APK/AAB (Android) and IPA (iOS) packages; extract manifest, permissions, embedded libs for SBOM/CVE. - SAST for mobile source (git/zip) + package static analysis (e.g. MobSF-class checks) — evaluate tooling. - DAST/dynamic: define feasibility per platform (Android emulator-based dynamic possible; iOS dynamic needs a device — mark limited). - Surface mobile-specific findings (insecure storage, exported components, ATS/cleartext). ## Acceptance criteria - APK and IPA fixtures ingest with manifest + permission extraction. - SBOM/CVE produced from bundled libraries. - Applicable-scan matrix reflects iOS dynamic = limited. ## Depends on ONB-02, ONB-03, ONB-04.
sharang added this to the Onboarding v1 milestone 2026-07-10 08:34:46 +00:00
sharang added the enhancementonboarding labels 2026-07-10 08:34:46 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels enhancement onboarding
Milestone
No items
No Milestone Onboarding v1
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#129