We assess the mobile release build you plan to ship. A person checks possible issues, then records what the evidence supports and what to do next.
Automated output is a candidate, not a finding. A reviewer checks it against evidence from the submitted release build and records why it was confirmed or rejected.
Follow the assessmentA possible issue becomes useful only when the submitted release artifact confirms it.
android:debuggable=trueIllustration only. Not a customer report.
Evidence, decisions and next steps stay connected in the report.
A tool can surface a possible issue. That signal stays unconfirmed until reviewed.
A reviewer checks the signal against the submitted build and records the reasoning.
A confirmed finding carries evidence, impact and a practical fix. A rejected candidate keeps its reason.
Vybebat assesses a named Android or iOS release build. It is not a penetration test or certification. Other work needs a separate written scope.
| Scope | Vybebat | Automated scan | Penetration test |
|---|---|---|---|
| Human review | Every candidate | Not inherent | Scope dependent |
| Release build | Core artifact | Tool dependent | Scope dependent |
| 24 MASVS controls | Standard profile | Not inherent | Scope dependent |
The boundaries are agreed before technical work begins.
Ownership proof, a mutual NDA and written authorisation are required before testing.
We request an APK, AAB or IPA and a dependency lockfile. Source code is not requested.
Client artifacts are handled in an isolated analysis environment and deleted within 30 days of report delivery.