RevDroid | AI Android APK Security Analyzer

⚠ Important — external service costs are NOT included in this purchase. RevDroid is a self-hosted application. Its AI features connect to a third-party LLM provider (OpenRouter), which bills you directly based on usage, and sign-in uses your own Google OAuth credentials. The purchase price does NOT include any API credits, subscriptions, or usage costs — you (the deployer) create your own provider accounts and pay them separately. The local static-analysis engine runs entirely on your machine and requires no paid service.

AI disclosure. RevDroid uses artificial intelligence. Its hunt agent is powered by large language models accessed through OpenRouter (you choose the model, e.g. Anthropic Claude, OpenAI, DeepSeek). The AI reasons over your local scan data to generate exploit-chain hypotheses, suggested steps and written summaries. AI output is assistive and must be verified by you; it does not replace manual testing. The 12-phase static-analysis engine itself is deterministic and uses no AI.

An APK is just a zip file. Anyone can open it. The only question is whether you looked first.

The moment your app hits a store, its bytes are on other people’s machines. A stranger can unzip it, decompile it, and read what you left inside in an afternoon. RevDroid lets you be the first person to do that — decompiling any Android APK, running a 12-phase security scan, and letting an AI agent turn the raw findings into real, step-by-step exploit chains. All of it runs locally. The app’s bytes never leave your machine.

Point it at an app. In minutes you see what a bounty hunter would see: the hardcoded key, the exported screen anyone can launch, the traffic going out in cleartext, the WebView that will run whatever JavaScript it is handed. Then an AI reasons over it and hands you the attack path, not a wall of warnings you will ignore.

Self-host it for yourself or your team. You own the full source and bring your own OpenRouter key.

You shipped it in a weekend. Do you actually know what you shipped?

AI copilots and no-code builders are astonishingly good at making an app work. They are not paid to make it safe, and they will happily paste your live API key straight into the build, leave the app debuggable, allow cleartext traffic, and export components that were never meant to be public. It compiles. It runs. It ships. And none of that shows up in a demo — it shows up when someone decompiles the release.

Here is what typically survives the “it works, push it” moment, and RevDroid finds every one of them:

• Your AWS, Stripe, Google or Firebase key sitting in plain text inside the APK, ready to copy
• An exported activity, service or content provider any other app on the device can call
• Cleartext HTTP and disabled TLS checks, quietly leaking data on every network
• A debuggable, backup-enabled release build that hands an attacker your app’s private data
• A WebView with a JavaScript bridge that turns a rogue page into code running in your app
• 40+ trackers you did not know you bundled, and native libraries with no hardening

None of this is your fault. Not seeing it before you shipped would be. Drop the APK you just built into RevDroid, read the findings in plain language, and fix them before a stranger turns them into your incident report. It is your app. Scanning it is the most authorized test there is.

What you can do with RevDroid

• Decompile and analyze any APK locally — the app’s bytes never get uploaded anywhere
• Run 12 static-analysis passes that stream to your dashboard live, so you watch the app give up its secrets in real time
• Let an AI agent read your scan data and propose verifiable exploit chains (hypothesis → steps → impact), not a checklist you will scroll past
• Catch hardcoded secrets, insecure code patterns, risky manifest components, trackers, and weak binaries before they ship
• Detect the app framework (Flutter, React Native, Xamarin, Unity, native) and adapt the scan to it
• Drive real Android devices over ADB — pull installed APKs, inspect security posture, view the live screen
• Keep per-conversation token and cost visibility on every AI run, so spend never surprises you

Who this is for

• Builders and “vibe coders” shipping AI-assisted or no-code Android apps fast — check your own release before the internet does, and turn “I hope it’s fine” into “I checked.”
• Indie devs and startups without a security team, who still can’t afford to leak a customer’s data or their own cloud keys
• Bug bounty hunters on HackerOne / Bugcrowd / YesWeHack who need signal over noise and speed to a valid finding
• Mobile pentesters & AppSec engineers running MASVS/MASTG-style assessments or reviewing their own org’s builds
• Security teams & consultancies who want to self-host a shared Android-security tool for their team under their own brand, with Google sign-in and per-conversation cost visibility