Read what the artifact declares
APK, AAB & IPA Build Artifact Inspector — Local Static Analysis
APK, AAB, and IPA files are archives with different metadata chains. Static inspection can inventory those declarations; it cannot prove what the installed app will do.
Artifact identity ledger
Format
APK / AAB / IPA
Package or bundle ID
Declared application identity
Version
Marketing and build values
Archive size
Compressed bytes
Minimum and target OS
Declared compatibility
Architectures
Bundled native slices
APK evidence path
archive → AndroidManifest.xml → components + permissions → DEX/resources/native libraries
- Activities, services, receivers, and providers
- Exported component surface
- Declared and dangerous permissions
- SDK levels and features
- Native libraries grouped by ABI
AAB evidence path
base module + feature modules + asset packs → device configuration → delivered APK set
- Module inventory and delivery type
- Configuration splits by ABI, density, and language
- Bundle manifest and SDK declarations
- Uncompressed contribution by module
IPA evidence path
.ipa → Payload/*.app → Info.plist → entitlements → embedded provisioning profile
- Bundle ID, version, and URL schemes
- ATS and background-mode declarations
- Entitlements and keychain groups
- Frameworks and Mach-O architectures
- Provisioning team, profile, and expiry
Signing evidence is not a trust verdict
Certificate subject, issuer, fingerprint, validity, and embedded scheme describe what is present. They do not prove store notarization, current revocation status, ownership, or runtime integrity.
Static inspection limits
Not executed
No code, service, or lifecycle behavior runs.
No malware verdict
Structure alone cannot declare an app safe.
No runtime permission state
User grants and OS dialogs are not observed.
No network proof
Endpoints and traffic are not contacted.
No privacy assessment
Data handling and policy compliance require broader evidence.
Mobile artifact questions
- Is an AAB the APK installed on a device?
- No. An app bundle contains modules and configuration resources that a delivery system uses to build device-specific APKs.
- Does a declared permission prove the app uses it?
- No. It exposes requested capability and review surface; runtime code paths, user grants, and OS behavior require separate evidence.
- Does inspection upload my release build?
- No. Archive reading and report generation occur locally in the browser worker.