🚨 That APK Looks Innocent. Let's Interrogate It.

APK-Xray: Evidence-First Android Security Analysis, Enhanced by AI

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle.

What I Built

An APK named Wedding Invitation.apk arrives on WhatsApp. It looks harmless—but a malicious app disguised as a wedding invitation can steal contacts, SMS messages, bank OTPs, and notification data. CERT-In's Cyber Swachhta Kendra documented this threat in its June 2025 SpyMax Android malware alert.

The scale of the problem matters, too: India recorded 86,420 cybercrime cases in 2023, according to NCRB data published by the Ministry of Home Affairs. (Ministry of Home Affairs · National Crime Records Bureau)

That raises a question: before installing an APK, how can we understand what it might be capable of doing?

That's why I built APK-Xray, an evidence-based Android APK security analyzer.

It extracts security-relevant metadata, including permissions and application components, then evaluates them using explicit detection rules. The goal is to make potential risks easier to investigate by showing the evidence behind each finding—not simply producing another alarming warning.

I also explored AI-assisted explanations to make technical findings easier to understand, while keeping evidence—not AI-generated claims—at the center of the analysis.

The principle: Don't just flag a potential risk. Show the evidence behind it.

APK-Xray is a static analysis tool, not a guarantee of safety. It helps investigate an APK's declared capabilities, but cannot establish everything the app might do at runtime.

Frontend

• React + TypeScript + Vite for a responsive, component-based interface.
• APK upload and analysis workflow with clear loading, error, and report states.
• Infographic security reports with finding cards, donut visualizations, pipeline steps, and progress indicators.
• Evidence-focused findings that help users understand detected APK capabilities.
• Multilingual interface with an English/Hindi selector.
• Light and dark themes for a flexible viewing experience.
• Reusable UI components with automated tests using Vitest and React Testing Library.
• Production-ready build verified through TypeScript checks and Vite.

Demo

Watch the APK-Xray Demo

Code

Explore the source code: GitHub Repository

Want to inspect the codebase with AI-assisted repository analysis? Explore APK-Xray on Gitingest.

Project Structure

APK-Xray/
├── backend/
│   ├── api.py                  # FastAPI endpoints and request handling
│   ├── parser/
│   │   └── apk_parser.py       # APK metadata extraction
│   ├── scoring.py              # Deterministic security rules and scoring
│   ├── gemma.py                # AI explanation integration
│   ├── report_builder.py       # Structured report generation
│   ├── report_store.py         # Report persistence
│   ├── sentry_setup.py         # Observability configuration
│   ├── schema/
│   │   └── report.schema.json  # Report contract
│   └── test_*.py               # Backend and integration tests
├── frontend/
│   └── src/
│       ├── api.ts              # Backend communication
│       ├── App.tsx             # Main application interface
│       ├── report.ts           # Report handling
│       └── components/         # Reusable UI components
└── README.md

The backend owns APK parsing, deterministic detection, scoring, report validation, optional Gemma explanations, and persistence. The React + TypeScript frontend handles uploads and presents the resulting security report.

🔗 Try APK-Xray

• Live Demo: https://apk-xray.vercel.app/
• Backend Health Check: https://apk-xray.onrender.com/api/health
• Source Code: https://github.com/justsamridhi/APK-Xray
• Gitingest Repository View: https://gitingest.com/justsamridhi/apk-xray

The live frontend lets you explore the APK-Xray interface, while the source code provides access to the implementation.

Note: The health-check endpoint confirms backend availability, not that every analysis or AI integration is functioning correctly. APK-Xray performs static analysis; APKs are not installed or executed.

🔍 The Problem: Security Warnings Aren't Enough

An APK requesting sensitive permissions isn't automatically malicious. A messaging app may legitimately need access to contacts, while an unrelated utility requesting SMS access deserves closer scrutiny.

The challenge is understanding which capabilities an app declares, why they matter, and what evidence supports a potential risk.

APK-Xray approaches this through three core ideas:

• Evidence over assumptions: Extract APK metadata and connect findings to explicit detection rules.
• Explainable findings: Make technical security signals easier to understand without presenting suspicion as proof.
• AI with boundaries: Use AI-assisted explanations to improve readability, not to replace static analysis or invent evidence.

The goal isn't to label every APK as safe or dangerous. It's to give developers and security learners a clearer starting point for investigating what an Android application may be capable of doing.

⚙️ How APK-Xray Works

APK-Xray transforms an Android APK into a structured, evidence-backed security report through four stages.

1. Extract — Understand the APK

The uploaded APK is parsed to extract security-relevant metadata, including declared permissions and application components.

2. Analyze — Evaluate Potential Risks

A rule-based detection engine evaluates the extracted metadata against explicit security rules. Each finding connects a potential risk to observable evidence rather than relying on vague warnings.

3. Explain — Make Findings Understandable

AI-assisted explanations help translate technical findings into clearer language. The AI provides context; the extracted metadata and detection rules remain the basis of the analysis.

4. Report — Present Actionable Findings

The results are organized into a structured report that helps users understand flagged capabilities, inspect supporting evidence, and decide what deserves further investigation.

The Workflow, at a Glance

APK Upload → Metadata Extraction → Rule-Based Analysis → AI-Assisted Explanation → Structured Security Report

The core principle: AI can explain the evidence, but it doesn't replace it.

APK-Xray uses static analysis, so it identifies potential risks from the APK's available metadata. It does not guarantee that an app is safe or establish every behavior that might occur at runtime.

🛠️ Engineering Decisions That Matter

Building APK-Xray wasn't just about detecting suspicious permissions. It was about making the analysis traceable, structured, and honest about uncertainty.

1. Deterministic Detection Over Black-Box Judgments

Explicit rules evaluate extracted APK metadata, making findings easier to inspect and reproduce. A permission alone isn't proof of malicious intent; combinations of capabilities and contextual evidence matter.

2. Separate Detection from Explanation

The rule engine produces findings, while Google Gemma helps explain them in accessible language. This separation keeps AI-generated text from becoming the sole basis for a security verdict.

3. Structured Reports Over Vague Alerts

A consistent JSON report makes findings easier to validate, display, test, and potentially integrate into other tools.

4. Static Analysis with Clear Boundaries

APK-Xray examines available package metadata without executing the application. It can identify declared capabilities and rule matches, but it cannot guarantee safety or reveal every runtime behavior.

These decisions reflect the principle behind the project: a useful security tool should explain not only what it flags, but also what its evidence can—and cannot—prove.

💡 What's Innovative About APK-Xray?

The innovation isn't simply using AI to scan an APK. It's separating evidence-based detection from AI-assisted interpretation.

APK-Xray is built around three ideas:

• Evidence-first security: Explicit detection rules connect potential risks to extracted APK metadata instead of relying on unexplained AI-generated verdicts.
• AI that explains, not decides: Google Gemma can help translate technical findings into understandable explanations, while the underlying analysis remains grounded in extracted evidence.
• Reports developers can inspect: Structured findings make the output easier to review, validate, and build upon.

Frontend Design Exploration

🚀 From Open-Source Project to Potential Side Hustle

For independent Android developers, small development teams, and security educators, understanding an APK's declared capabilities can be a useful part of a security review.

APK-Xray explores how that analysis could become a developer-focused service: upload an APK, inspect potential risks, understand why a rule was triggered, and review a structured report.

The longer-term opportunity is to expand this into features such as historical report comparison, batch analysis, and multilingual explanations—subject to implementation and validation.

I'm not claiming paying customers or proven market demand yet. The next step is to put APK-Xray in front of real developers, learn which parts of the workflow save them time, and validate whether the tool solves a problem worth paying for.

The bigger idea: make Android security findings easier to understand without making them less rigorous.

🤖 Inside the Build: Agent Tracing with Sentry

To understand what happens during an APK analysis request, I instrumented APK-Xray's FastAPI backend with Sentry tracing. Instead of treating /api/upload as a single operation, I added spans around key stages of the pipeline so I could inspect their execution times, relationships, and status.

How the Tracing Works

When an APK is uploaded, the backend processes the request through several stages. Sentry records these operations as spans within the parent HTTP transaction.

Operation	What it tracks
http.server — /api/upload	Overall request duration
apk.parse — Parse APK manifest	APK metadata extraction
apk.report — Build and validate report	Report construction and validation
ai.lifecycle — AI explanation workflow	Execution status of the explanation workflow
apk.persist — Persist report to SQLite	Database persistence time

The trace waterfall shows how these operations relate to the parent request, while the span explorer exposes individual durations and recorded attributes.

What the Traces Revealed

One captured /api/upload transaction completed in 13.70 ms.

Span	Recorded duration
Overall HTTP transaction	13.70 ms
Report persistence to SQLite	Approximately 9.88 ms
Manifest parsing	Less than 1 ms
Report construction and validation	Less than 1 ms

These measurements come from one captured request, not a general performance benchmark.

The traces also showed an AI explanation not configured state in some executions. This helped distinguish a recorded workflow from an external AI integration that was actually configured and running.

Why This Matters

Sentry helps me inspect execution paths, investigate latency, and identify where further debugging is needed. For a security-focused application, I also want observability to respect privacy: operational telemetry should not unnecessarily expose uploaded APK contents or sensitive information.

Trace Evidence

The following screenshots show the actual instrumentation from three perspectives:

• Trace overview: Recorded spans across multiple requests.
• Request waterfall: The parent transaction and its child operations.
• Span explorer: Individual span attributes and durations.

Together, they provide evidence that APK-Xray's backend has instrumented analysis stages and that the recorded traces can be inspected. They do not, by themselves, prove that every external AI integration is active in production.

🧠 Google Gemma 4: AI That Explains the Evidence

Most security tools can flag a suspicious permission. APK-Xray takes the next step: helping users understand what that finding means, without letting AI invent the evidence.

Here's how Gemma 4 fits into the actual analysis pipeline.

1. Static analysis comes first. Androguard extracts APK manifest metadata, and APK-Xray's deterministic rules identify security-relevant indicators and calculate the exposure score.
2. Gemma receives normalized evidence. When configured, the Gemma 4 integration sends the extracted evidence and relevant app facts to the model—not the original APK.
3. The model generates explanations. Gemma returns structured claims with evidence IDs and explanations in both English and Hindi. Each claim distinguishes between what the evidence supports, what something could indicate, and what cannot be proven.
4. The backend validates the response. Claims referencing unknown evidence IDs are rejected, and the expected output structure and both language explanations are checked.
5. The report remains usable if AI fails. If Gemma is unavailable or its response fails validation, APK-Xray preserves the deterministic findings and score rather than relying on an invalid AI response.

Why This Design Matters

APK-Xray's deterministic engine	Gemma 4
Extracted evidence and rule matches	Human-readable explanations
Controls findings, severity, and score	Produces evidence-linked claims
Establishes what the analysis observed	Explains what those observations may mean
Remains available if AI fails	Is an optional explanation layer

This separation is deliberate. Gemma cannot add evidence, change a finding's severity, or modify the exposure score. It never receives the APK itself.

For example, if an APK declares SMS-reading permissions, the rules engine can flag that capability. Gemma can help explain why it deserves scrutiny—but that permission alone does not prove the application is malicious.

The integration also supports English and Hindi explanations, making technical findings more accessible to a wider range of users.

The principle behind APK-Xray: let rules establish the evidence, let AI explain it, and never confuse an explanation with proof.

🏆 Prize Categories

1. Sentry — Agent Tracing & Observability

APK-Xray uses Sentry tracing to make the backend analysis pipeline observable at the request and operation level. Traces capture stages including http.server (/api/upload), apk.parse, apk.report, ai.lifecycle, and apk.persist. This provides visibility into request execution, parsing, report construction, AI-explanation handling, and SQLite persistence.

In one captured trace, the request completed in 13.70 ms, with SQLite persistence accounting for approximately 9.88 ms. These traces help identify performance bottlenecks and investigate failures across the pipeline. The captured telemetry also shows when AI explanations are not configured, helping distinguish deterministic analysis from optional AI functionality.

2. Google Gemma 4 — Evidence-Grounded Security Explanations

Gemma 4 provides the natural-language explanation layer on top of APK-Xray's deterministic security analysis. The backend sends normalized application facts and security evidence to the configured model endpoint—not the raw APK file.

The model generates structured explanations in English and Hindi, linked to evidence IDs and constrained to the classifications Can, Could, and Cannot Prove. The backend validates the response structure and evidence references before accepting the output. Unknown evidence IDs and invalid responses are rejected.

Crucially, Gemma explains findings; it does not perform the underlying rule-based detection or determine the exposure score. If the model is unavailable or its response fails validation, the deterministic report remains available.

3. Render — Cloud Deployment for the Analysis API

APK-Xray's backend is deployed on Render using FastAPI and Python, connecting the deployed React + TypeScript frontend to the static-analysis pipeline. The API exposes endpoints for health checks, APK uploads, and report retrieval:

• GET /api/health — checks backend availability.
• POST /api/upload — accepts and processes an APK for analysis.
• GET /api/report — retrieves the generated report.

The upload workflow validates file properties, processes the APK using Androguard, evaluates deterministic security rules, and constructs a structured report. APKs are analyzed statically; they are not installed or executed.

Live endpoints: Backend Health Check · Deployed Application

4. GitHub Copilot — AI-Assisted Engineering

GitHub Copilot supports the development workflow through AI-assisted coding, implementation exploration, and testing. For a security-analysis project, the important distinction is between assistance during development and behavior in the shipped application: Copilot is a development tool, not part of APK-Xray's runtime detection pipeline.

The core analysis remains explicit and testable through Python rules, structured report generation, and schema validation. This separation keeps security findings auditable instead of relying on an opaque, AI-generated verdict.

👥 Team

Built by Samridhi Gupta — project design, implementation, and integration of the APK-Xray analysis pipeline.

Contributor: Aditya Modani (DEV: @modapk06).

Comments

[Samridhi Gupta]

Hey @jem 👋 I just submitted APK-Xray for the Hacktoberfest Open-Source AI Challenge: Side Hustle!

It’s an evidence-first Android APK security analyzer that combines deterministic static analysis with Gemma 4 for evidence-linked explanations in English and Hindi. I’ve also worked on Sentry tracing to make the backend pipeline more observable.

The core idea is simple: let rules establish the evidence, and let AI explain it—not invent it.

Would love to hear your thoughts on the project! 🚀

🔗 dev.to/justsamridhi/that-apk-looks...

[Samridhi Gupta]

Hey @jem and @thepracticaldev team 👋 I just submitted APK-Xray for the Hacktoberfest Open-Source AI Challenge: Side Hustle!

APK-Xray is an evidence-first Android APK security analyzer that combines deterministic static analysis with Gemma 4 for evidence-linked explanations in English and Hindi. I’ve also integrated Sentry tracing to make the backend pipeline more observable.

The core idea is simple: let rules establish the evidence, and let AI explain it—not invent it.

I'd love to hear your thoughts on the project. Thanks for organizing a challenge that encourages us to build practical, open-source AI applications! 🚀

🔗 dev.to/justsamridhi/that-apk-looks...