Skip to main content

Overview

Bugsmirror CodeLock is the best SAST tool, providing fast, accurate, and in-depth static security testing for Android and iOS mobile applications. It provides a detailed security report and highlights critical issues. It clearly shows how secure your mobile application is against a wide range of threats, providing developers with actionable insights to fix issues quickly. This reduces the time spent on security investigations, allowing teams to focus more on application design, performance, and feature development. Just upload your Application, and we’ll identify exactly where the vulnerabilities reside in your code so that you have a secured product. Get your app analysed for 50+ different vulnerabilities before the big release.

CodeLock helps in:​

  • Codebase Collection & Setup

Collect the mobile app codebase (or APK/IPA file) and prepare a secure environment for analysis.

  • Static Scanning

Perform static code analysis using our indigenous SAST tools and proprietary scanning scripts.

  • Manifest Analysis

Audit the AndroidManifest.xml (or Info.plist) for exposed components, risky permissions, debugging configurations, and broadcast receivers.

  • Obfuscation & Encryption Review

Evaluate the effectiveness of code obfuscation, encryption standards used, and identify any readable sensitive data within the app binary.

  • Secrets & Credentials Detection

Locate hardcoded credentials, API keys, tokens, and sensitive strings exposed within the code.

  • Intent Security & Component Interaction

Analyse deep links, intent handling, and exported components for spoofing, hijacking, or StrandHogg-like attacks. Detects unsafe implicit intents and insecure
inter-app communication patterns.

  • Network Security Assessment

Statically Analyze SSL/TLS implementation, certificate validation, trust manager configurations, cleartext traffic usage, and insecure protocol detection.

  • Security Misconfigurations & Insecure Implementations Analysis

Audit the decompiled code for insecure logging of sensitive data, WebView misconfigurations, insecure File Provider implementations, unsafe Pending Intents and various other critical security misconfigurations and implementation flaws that could lead to data exposure or unauthorized component access.

How CodeLock works:​

CodeLock is an advanced, fully automated static application security testing tool that analyses binary code to detect vulnerabilities without executing the mobile app. It decompiles mobile app files and scans for vulnerabilities. It does not need your source code, thus protecting IP.

The tool provides clear insights into:

  • Where vulnerabilities exist.
  • Why do they pose a risk?
  • How developers can fix them.

Why is CodeLock the best SAST Tool?​

CodeLock is built specifically for mobile application security, not retrofitted from web-only SAST tools. Its mobile-first approach ensures higher accuracy, fewer false positives, and better developer usability.

  • Designed for mobile ecosystems.
  • Early detection of security flaws.
  • Developer-friendly reporting.
  • Seamless integration into security workflows.

CodeLock Dashboard Overview​

The CodeLock tab provides a summary of your scanning activity:

  • Total Scans: Total number of scans performed.
  • Completed: Scans successfully completed.
  • Failed: Scans that failed due to technical issues.
  • Pending: Scans yet to start.
  • Processing: Scans currently in progress.

Start a new SAST scan by clicking on the + New Release button.

All scanned files are listed below and can be easily searched using the search bar.

You can also download a sample report directly from the MASST portal.

Last updated on