Severity, confidence & findings
Every rule emits findings. A finding carries a
deterministic id (stable across runs), the rule_id,
a title, a severity, a confidence, a description, evidence
strings, a standards taxonomy, an optional proof/witness chain,
and an optional location (class / method / instruction offset, or
a bundled artifact / native symbol / container layer).
Severity (rank low to high):
Info,
Low,
Medium,
High,
Critical.
Confidence: Low, Medium,
High (hand-assigned per rule, not scored). Some rules
grade severity per finding rather than fixing one default.
For reporting, findings are faceted into display categories keyed
off their CWE — Injection, Secrets, Components, Crypto, Transport,
Dependencies, Other. Each finding also carries a standards
taxonomy with up to five id lists: CWE, MASVS (Android), CIS,
SSDF, and SLSA.
A few rules are opt-in by analysis mode, not by licence:
the three apk-signature-* rules require
--verify-signature; the interprocedural passes for
taint-reaches-sink and weak-crypto-algorithm
require --interprocedural. No individual rule is
paywalled.
Android rules
Crypto
| Rule id | Severity | Triggers when |
|---|
weak-crypto-algorithm | High | A broken/risky cipher or digest (DES, RC4, MD5, ECB, RSA without OAEP) resolved at a JCE call site. |
hardcoded-crypto-key | High | A literal byte array flows into SecretKeySpec.<init>. |
static-initialization-vector | Med/High | A literal IV byte array flows into IvParameterSpec.<init> alongside CBC. |
insecure-random-for-crypto | Med/High | java.util.Random / Math.random() used alongside crypto key/IV/nonce material. |
Network & TLS
| Rule id | Severity | Triggers when |
|---|
cleartext-traffic-permitted | Medium | Cleartext HTTP permitted (explicit flag, or inferred from targetSdk<28). |
network-security-config-insecure | Medium | NSC XML permits cleartext or trusts user-installed CAs outside debug. |
insecure-trust-manager | High | X509TrustManager.checkServerTrusted is an empty no-op (accepts every chain). |
permissive-hostname-verifier | High | HostnameVerifier.verify unconditionally returns true. |
webview-ssl-error-proceed | High | onReceivedSslError always calls proceed(), never cancel(). |
android-legacy-ssl-context-protocol | Medium | SSLContext.getInstance requests SSLv3 / TLSv1 / TLSv1.1 etc. |
WebView
| Rule id | Severity | Triggers when |
|---|
webview-javascript-bridge | High | addJavascriptInterface exposes a Java object to page JS. |
webview-insecure-file-access | High/Med | setAllowUniversalAccessFromFileURLs / setAllowFileAccessFromFileURLs enabled. |
webview-mixed-content-allowed | Medium | setMixedContentMode(MIXED_CONTENT_ALWAYS_ALLOW). |
webview-contents-debugging-enabled | Medium | setWebContentsDebuggingEnabled(true). |
Manifest, permissions & config
| Rule id | Severity | Triggers when |
|---|
android-debuggable | Medium | android:debuggable="true". |
android-allow-backup | Low | ADB/cloud backup allowed. |
android-test-only | Info | android:testOnly="true". |
weak-custom-permission | Medium | A custom permission with a weak protection level guards a component. |
privileged-permission-requested | Low | A high-impact permission from a small allowlist is requested. |
min-sdk-below-supported | Info | minSdk < 23 (below the runtime-permissions floor). |
IPC & components
| Rule id | Severity | Triggers when |
|---|
exported-component-no-permission | Med/Low | An exported component has no permission guard. |
implicitly-exported-component | Medium | A component is implicitly exported via an intent-filter (pre-API-31 default). |
exported-activity-echoes-caller-intent | Medium | Exported Activity returns the caller's own Intent via setResult(int, getIntent()). |
implicit-intent-carries-extras | Medium | An implicit Intent carrying extras is broadcast / started. |
provider-grant-uri-permissions | Medium | An exported provider grants URI permissions. |
file-provider-path-overly-broad | Medium | A FileProvider <paths> entry maps a filesystem root. |
dynamic-receiver-registered-exported | Medium | Runtime registerReceiver without export control on targetSdk<34. |
clipboard-write-not-marked-sensitive | Low | setPrimaryClip without EXTRA_IS_SENSITIVE. |
Injection & runtime code
| Rule id | Severity | Triggers when |
|---|
command-injection-via-exec | High | Untrusted input reaches Runtime.exec / ProcessBuilder. |
sql-injection-via-rawquery | High | Untrusted input (incl. EditText/TextView) reaches rawQuery / execSQL. |
taint-reaches-sink | per-sink | Generic taint-to-sensitive-sink flow; severity depends on the sink. |
dynamic-code-loading-detected | Low | A DexClassLoader / PathClassLoader is constructed. |
xml-parser-dtd-not-disabled | Medium | An XML parser is created without disabling DTD/external-entity processing. |
Storage & secrets
| Rule id | Severity | Triggers when |
|---|
keystore-or-cert-bundled-in-apk | Crit/Low | A private key / keystore (Critical) or plain certificate (Low) is bundled in the APK. |
android-hardcoded-secret | High/Low | A server secret (PEM key, AWS AKIA, GitHub/Slack token, JWT) or a client API key is embedded. |
world-readable-file-mode | High/Med | MODE_WORLD_READABLE / MODE_WORLD_WRITEABLE file mode. |
firebase-database-endpoint | Low | A *.firebaseio.com endpoint is referenced. |
Attestation, auth & signature
| Rule id | Severity | Triggers when |
|---|
deprecated-safetynet-attestation | Medium | The deprecated SafetyNet Attestation API is called. |
biometric-auth-without-cryptoobject | Medium | BiometricPrompt.authenticate without a CryptoObject. |
apk-signature-invalid | Critical | Signature integrity check fails (requires --verify-signature). |
apk-signature-untrusted | High | Signer doesn't match an expected fingerprint (--verify-signature). |
apk-signed-with-debug-certificate | High | Signed with the public Android debug certificate (--verify-signature). |
Linux / ELF rules
Binary-hardening and import-table checks over ELF binaries.
| Rule id | Severity | Triggers when |
|---|
linux-executable-stack | High | Stack is executable (NX off). |
linux-no-pie | Medium | Not a position-independent executable. |
linux-relro-weak | Med/Low | RELRO absent or only partial. |
linux-insecure-search-path | Med/Low | Insecure RUNPATH/RPATH, or deprecated DT_RPATH present. |
linux-writable-executable-segment | Medium | A W+X segment. |
linux-legacy-tls-protocol | Medium | OpenSSL SSLv2/SSLv3/TLSv1 method constructor imported. |
linux-weak-crypto-cipher | Medium | A weak cipher function imported. |
linux-no-stack-canary / linux-no-fortify-source | Low | No stack-canary / no _FORTIFY_SOURCE imports. |
linux-unsafe-string-function, linux-shell-execution, linux-path-searched-exec | Low | Unsafe string / shell-invoking / PATH-searching exec functions imported. |
linux-weak-hash, linux-insecure-random | Low | Weak hash / non-crypto RNG imported. |
linux-insecure-temp-file, linux-toctou-prone-api | Low | Race-prone temp-file / TOCTOU access() imported. |
linux-dynamic-library-loading, linux-privilege-management-api | Low | Runtime dlopen / setuid-family imported. |
linux-worldwritable-permission-api, linux-format-string-risk, linux-obsolete-network-api | Low | chmod-family / syslog / gethostbyname imported. |
linux-hardcoded-secret-string | Low | A credential-shaped string in a non-executable section. |
linux-linkage-not-analyzable | Info | The dynamic symbol table couldn't be recovered (e.g. static linking). |
Windows PE & .NET rules
PE hardening & linkage
| Rule id | Severity | Triggers when |
|---|
windows-no-dep | High | DEP/NX not enabled. |
windows-no-aslr, windows-no-cfg, windows-no-safeseh | Medium | ASLR / Control Flow Guard / SafeSEH not effective. |
windows-writable-executable-section | Medium | A W+X section. |
windows-unsigned-or-unverifiable | Medium | No embedded Authenticode signature. |
windows-excessive-execution-level | Medium | Manifest requests requireAdministrator. |
windows-manifest-highest-available, windows-no-high-entropy-aslr, windows-pdb-path-leak | Low | highestAvailable manifest / no high-entropy ASLR / PDB path leaked. |
windows-dll-hijack-risk | Medium | DLL-search-order hijack risk. |
windows-insecure-crt-function | graded | Unsafe C-runtime functions imported. |
windows-command-execution, windows-crypto-api-usage, windows-insecure-random, windows-dynamic-library-loading, windows-privilege-management-api, windows-obsolete-network-api, windows-insecure-temp-file, windows-toctou-prone-api, windows-worldwritable-permission-api | Low | Corresponding risky Win32/CRT imports. |
windows-hardcoded-secret-string | Low | A credential-shaped string in a non-executable section. |
windows-hardening-not-analyzable, windows-linkage-not-analyzable | Info | A check couldn't run on this image. |
.NET managed metadata
| Rule id | Severity | Triggers when |
|---|
dotnet-weak-crypto-reference, dotnet-unsafe-deserialization, dotnet-allow-partially-trusted-callers, dotnet-insecure-json-deserialization | Medium | Reference to a weak crypto type / unsafe deserializer / APTCA / polymorphic JSON type handling. |
dotnet-no-strong-name, dotnet-dynamic-code-loading, dotnet-tls-validation-callback, dotnet-process-execution, dotnet-hardcoded-secret, dotnet-unverifiable-code, dotnet-xxe-risk, dotnet-dynamic-code-generation | Low | Not strong-named / dynamic assembly load / custom TLS callback / Process.Start / secret in #US heap / unsafe IL / XXE reader / Reflection.Emit. |
dotnet-managed-assembly, dotnet-mixed-mode | Info | A managed / mixed-mode assembly detected. |
Windows PE support is actively maturing: the PE parser's tests
are synthetic fixtures rather than a corpus of real Windows
binaries, so treat PE results with less proof depth than the
Android rules. See Maturity &
coverage.
iOS / Mach-O rules
| Rule id | Severity | Triggers when |
|---|
ios-ats-arbitrary-loads | High | App Transport Security disabled for all connections (NSAllowsArbitraryLoads). |
ios-entitlement-overbroad | Medium | A wildcard keychain-access-group / app-group entitlement. |
ios-ats-exception-domain-declared, ios-url-scheme-declared | Low | A per-domain ATS exception / a custom URL scheme declared. |
ios-binary-not-pie | Medium | Binary is not position-independent. |
ios-binary-weak-crypto-api, ios-binary-keychain-weak-accessibility, ios-binary-webview-bridge | Medium | Weak crypto imported / weak Keychain accessibility / deprecated UIWebView or JS bridge. |
ios-binary-no-stack-canary, ios-binary-arc-disabled, ios-binary-insecure-randomness | Low | No stack canary / no ARC helper / non-crypto RNG. |
ios-binary-jailbreak-detection, and the *-not-analyzable rules | Info | Jailbreak-detection code referenced / a check couldn't fully run. |
Container rules
Misconfiguration, filesystem, build-history, secret, and Dockerfile checks over container images (a separate registry from the native rules).
| Rule id | Severity | Triggers when |
|---|
container-writable-passwd-or-shadow | Critical | /etc/passwd or /etc/shadow is world-writable. |
container-empty-password-account | Critical | A uid-0 account has an empty password hash. |
container-layer-secret, container-deleted-layer-secret | Critical | A credential-shaped file shipped in a (possibly deleted-later) layer. |
container-root-user, container-credential-env, container-credential-label | High | Runs as root / credential-shaped env var or label baked in. |
container-secret-in-image-history, container-curl-pipe-shell-in-history | High | Secret in build history / remote content piped into a shell during build. |
container-dockerfile-missing-user | High | Dockerfile has no USER instruction. |
container-broad-exposed-port, container-setuid-setgid-binary, container-world-writable-path, container-escaping-symlink, container-git-directory-shipped, container-broad-chmod-in-history, container-dockerfile-mutable-base-tag | Medium | Sensitive exposed port / setuid binary / world-writable path / escaping symlink / .git shipped / broad chmod / unpinned base image. |
container-missing-healthcheck, container-package-manager-cache, container-dockerfile-add-instead-of-copy | Low | No HEALTHCHECK / package-manager cache left in / ADD where COPY would do. |
container-package-coverage-gap | Info | Part of the image couldn't be fully analysed. |
A CIS Docker Benchmark framework is available via
rutken image scan --framework cis-docker, and known
vulnerable OS/language packages surface as
sca-known-vulnerable-component from the SCA engine.
Data packs
Three first-party packs ship as declarative JSON (publisher
rutken) and load through the same matcher pipeline —
the same mechanism available to your own
plugins.
high-risk-permissions
| Rule id | Severity | Permission |
|---|
request-install-packages | Medium | REQUEST_INSTALL_PACKAGES |
system-alert-window-overlay | Medium | SYSTEM_ALERT_WINDOW |
read-sms / receive-sms | Medium | READ_SMS / RECEIVE_SMS |
query-all-packages | Low | QUERY_ALL_PACKAGES |
runtime-code-execution
| Rule id | Severity | Call |
|---|
runtime-exec | Medium | Runtime.exec |
process-builder-start | Medium | ProcessBuilder.start |
dex-classloader | Medium | DexClassLoader.<init> |
cloud-credentials
| Rule id | Severity | Matches |
|---|
aws-access-key-id | High | Prefix AKIA |
slack-token | High | Prefix xoxb- |
stripe-live-secret-key | High | Prefix sk_live_ |
private-key-pem | High | Contains PRIVATE KEY----- |
Maturity & coverage
Android is the flagship, deepest-tested surface. The native
(Linux, Windows, iOS) and container rules are built and run in the
engine's unit tests, but several do not yet have a witness in the
internal vulnerable-app corpus — the engine tracks exactly which
rules lack a corpus witness. Present non-Android results
accordingly: the rule logic is there, but it has less real-world
proof depth than the Android set, and the Windows PE parser in
particular is validated against synthetic fixtures rather than
real binaries.
Because this catalog is a snapshot, always confirm the live set
for your build and platform:
rutken app.apk rules --list-rules
rutken app.apk rules --list-rules --platform android
Want a rule that isn't here? Write a
plugin pack — the matcher
grammar covers permissions, components, SDK levels, method calls,
string constants, taint flows, and class-hierarchy relationships.