Verify the build.
Project the evidence.
Sign the report.
Veriferium is software for mobile security operators. Inspect an Android APK, review static findings and coverage limitations, and export the results. The current owner preview runs Quick and Standard static scans. Runtime and active-network testing remain separately gated. Report-safe evidence keeps claim, evidence, caveat together.
The Veriferium pipeline
Concept diagram of the broader pipeline. The owner preview exercises Android static analysis; runtime and network execution are separately gated.
Inside the Android static owner preview
Actual dashboard capture, 2026-10-18: two scans of the same owned test application. This is a frozen demonstration, not customer activity or a detection-accuracy benchmark.
One pipeline,
three vantage points.
The broader pipeline brings static, runtime and network evidence together. In the current owner preview, Quick and Standard run built-in Android static analysis. Runtime and active-network execution remain gated; the diagrams illustrate the product direction, not a completed multi-phase assessment.
Three analyzers,
built to disagree.
Static findings support operator triage; they do not prove runtime exploitation. Findings and coverage notices remain separate. Runtime and network capabilities below are gated foundations outside this Android static preview.
Android static checks in the owner preview, with explicit coverage limitations. Broader iOS/source-analysis support requires separate evidence.
- Android APK owner preview; iOS separately gated
- Secrets, certificates, taint sources
- Permission & capability mapping
- 57 generated plugins in the broader source inventory
Real runtime instrumentation: hand-authored Frida hooks, policy-gated UI driving, and operator-grade manual sessions.
- Frida hook runtime with full inventory
- UI Driving v2: UIAutomator crawl + scripted preflight
- Manual driving over auth’d WebRTC
- Provider-check: fail-closed, no-network
Hosts, endpoints, taint flows. We capture what flows out of the app and what flows back — then summarize it without leaking it.
- TLS / pinning · host inventory
- Endpoint taxonomy & counts
- Source → sink taint summaries
- Bodies stay inside the boundary
A boundary between
what we see and what we say.
One careless copy-paste is all it takes to ship a client’s secret inside your deliverable. Veriferium’s analyzers see authorization headers, request bodies, runtime memory, and proof payloads — your reports never do. Normal exports pass through a report-safe projection boundary that surfaces findings, summarizes evidence, and keeps the raw material sealed behind audit-gated internal controls. SARIF is forced through the safe profile for CI consumption.
What the analyzers see.
Internally, Veriferium captures the full picture — headers, bodies, proof code, taint values — and seals it into an encrypted vault with audit and retention policy.
What every report contains.
Externally, normal report consumers read report-safe output: claim, evidence reference, plain-language caveat. No raw bodies, no proof code.
Drive the app like a user.
With a policy that never blinks.
Gated Android control foundations, outside this static preview. Device interaction requires a separately authorized runtime execution. The illustration is a concept, not a recording of a completed device session.
Manual sessions over authenticated WebRTC.
The control path borrows the canonical execution's Android device. Stopping manual control does not release that execution's device. Saved scripted-flow execution remains deferred.
Findings that
explain themselves.
Concept view of cross-finding evidence. The Android static owner preview exposes limited graph summaries and does not establish runtime-backed attack chains. Review the actual findings and limitations rather than treating this diagram as evidence from a completed assessment.
Anatomy of a verifiable chain.
A storyboard, not a CSV. Each step is a finding with its own analyzer provenance, evidence reference, and caveats. Path-source limits are surfaced rather than hidden — you can always see where the graph ends.
Seven export formats.
One report-safe boundary.
All seven formats were exercised on an owned Android test scan in the preview; renderer availability still depends on the environment. This example report is illustrative, not customer evidence. Whether a finding leaves the system as a PDF for an auditor, a SARIF file for CI, or a JSON bundle for an engineer, normal reports pass through a report-safe projection boundary. Allowed phrasing is validated automatically. SARIF is forced through the safe profile for CI consumption.
Format coverage.
Pick the surface that fits your audience. Normal formats stay inside the report-safe boundary — there’s no “raw mode.”
Mapped to the standards
your auditors already trust.
Findings, evidence references, and projection metadata are mapped to industry standards to support your assessment workflow — a traceability matrix instead of a screenshot. Coverage is reported qualitatively; Veriferium maps evidence rather than asserting formal compliance.
Bring a build.
Leave with a report you can sign.
Requests receive manual review, not automatic onboarding or approval to upload customer APKs.