android_secrets_scanner
Scans Android APKs to detect hardcoded secrets and API keys. Supports both direct APK analysis and deeper scanning with decompiled smali output.
Instructions
Scans an APK for hardcoded secrets and API keys. Without smali_folder: runs strings on classes*.dex and resources.arsc, plus scans text assets inside the APK. With smali_folder (apktool output): scans res/values/strings.xml and assets as plain text files.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| apk_path | Yes | Absolute path to the APK file | |
| smali_folder | No | Absolute path to apktool decompiled output folder (optional) | |
| min_length | No | Minimum string length for strings command (default 8) |