FraudShield

A security and fraud-risk scanner for our mobile apps. Point it at source code (Flutter, Kotlin, SwiftUI, KMP) or a built app (.apk, .aab, .ipa). It reports weaknesses that attackers and scammers abuse, explains how each one gets abused, and tells you how to fix it.

• Pure Python 3.8+, no dependencies, no internet (except the optional --deps check). Your code never leaves your computer.
• Results are printed in the terminal and saved to an HTML report you can share. JSON and SARIF output are available for CI.
• Every finding is mapped to the OWASP MASVS mobile security standard.

Install

brew install pipx && pipx ensurepath     # once, if you don't have pipx
pipx install fraudshield-mobile

Update later with pipx upgrade fraudshield-mobile.

Quick start

# Source code: one app, or a folder full of apps
fraudshield ~/code/wallet-app
cd ~/code/wallet-app && fraudshield .

# Built apps: scan what you are about to ship
fraudshield build/app/outputs/flutter-apk/app-release.apk
fraudshield build/ios/ipa/Wallet.ipa

# Everything at once, plus a dependency check
fraudshield ~/code/wallet-app app-release.apk Wallet.ipa --deps

Open fraudshield-report.html to see the full report. You can filter it by severity and search it. It also includes a checklist of server-side fraud controls to confirm with the backend team.

Why scan both source and the build?

Run the source scan on every pull request. Run the build scan on the release artifact before uploading it to the Play Store or App Store.

What it checks

Options

Silencing a false positive

Add a comment on the line, or on the line above it. Always say why:

Log.d(TAG, "token refreshed")  // fraudshield:ignore LOG001 - no value logged

Debug-only code is skipped automatically: if (BuildConfig.DEBUG) { … }, if (kDebugMode) { … } and #if DEBUG … #endif.

Using it in CI

GitHub Actions:

- run: pipx install fraudshield-mobile
- name: FraudShield (source)
  run: fraudshield . --fail-on high --sarif fraudshield.sarif --html fraudshield.html
- name: FraudShield (release build)
  run: fraudshield build/app/outputs/flutter-apk/app-release.apk build/ios/ipa/*.ipa --fail-on high --no-html
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with: { sarif_file: fraudshield.sarif }
- uses: actions/upload-artifact@v4
  if: always()
  with: { name: fraudshield-report, path: fraudshield.html }

Codemagic or a shell script: pipx install fraudshield-mobile && fraudshield . --fail-on high || exit 1

Reading the grade

Limits (please read)

• The scanner matches patterns. It catches the common mistakes quickly, but it's not a penetration test. Some findings will need a human to confirm them, and some problems can't be seen by pattern matching.
• It can't see your backend, and most real fraud losses come from missing server-side controls: amount and fee recomputation, idempotency, OTP limits, IDOR checks, SIM-swap checks, velocity rules. The HTML report ends with a checklist for these.
• For built apps:
  • Native FLAG_SECURE is a numeric constant, so it can't be seen in a build. Confirm it with a source scan.
  • App Store-downloaded IPAs are encrypted. Scan the IPA exported from Xcode or CI instead.
  • For .aab files the manifest isn't decoded. Use bundletool build-apks --mode=universal and scan the APK too.
• Secret values are masked in all reports, so reports are safe to share.

Code layout

Development

python3 -m unittest discover -s tests -v      # 18 tests
python3 tests/make_test_apps.py               # builds vulnerable test APK/IPA into tests/build/
python3 fraudshield.py path/to/app            # run from this folder without installing

tests/fixtures/ contains small, deliberately vulnerable Flutter, Kotlin, SwiftUI and KMP apps, plus one clean app that must produce zero findings. The fake keys are inserted at test time, so the repo never contains anything that looks like a real secret and GitHub push protection won't block it. Binary tests build real APKs and an IPA with the Android SDK and Xcode, and are skipped on machines without them.

To add a rule, add an R(...) entry to RULES in fraudshield/rules.py, add a vulnerable line to a fixture, and assert it in tests/test_fraudshield.py. Keep the clean app clean.