traze

Automated Android app security scanner (SAST + DAST) for indie developers. Upload your own APK, get a pentest — static and dynamic analysis, findings mapped to OWASP MASVS, with severity and a suggested fix for each. Everything runs locally on your machine; your APK and source never leave it.

Install

npm i -g @theremax/traze

The terminal command is traze. On a global install it automatically sets up the static-analysis toolchain (a few minutes, one time). You can re-run that any time with traze setup.

Requirements

traze orchestrates real tools. It installs the lightweight ones for you; a few system-level ones you provide:

| Need | For | Install | | --- | --- | --- | | Node ≥ 22.13 | the CLI | nodejs.org | | Java | the decompilers | brew install openjdk (or a JDK) | | Docker | binary/manifest analysis (MobSF) | Docker Desktop | | Python 3 | the analysis engines | python.org / brew install python | | Android SDK | dynamic analysis only | Android Studio, or see below |

Check what's present at any time:

traze doctor

It names exactly what's missing and how to fix it.

Quick start

1. Static analysis — fast, no emulator. You must confirm the app is yours to assess (--i-own-this):

traze scan ./my-app.apk --i-own-this

2. Enable dynamic analysis (optional, one-time heavier download — the Android emulator and runtime tools):

traze install dast

3. Full analysis — static + dynamic, end to end:

traze full ./my-app.apk --i-own-this

Interactive mode

Just run traze with no arguments to open the interactive assistant, where you can drive scans and ask about any finding in plain language:

traze

Commands

| Command | What it does | | --- | --- | | traze | Open the interactive assistant (REPL). | | traze scan <app.apk> --i-own-this | Static analysis (SAST). | | traze full <app.apk> --i-own-this | Static + dynamic, end to end. | | traze dast <app.apk> --i-own-this | Dynamic analysis only. | | traze report <scan.json> | Turn a scan into a plain-language report. | | traze export [report.json] | Save a report as shareable HTML (printable to PDF). | | traze doctor | Check that every dependency is installed. | | traze setup | Install the static-analysis toolchain. | | traze install dast | Install the dynamic-analysis toolchain (emulator + runtime tools). | | traze emulator [status\|start\|stop] | Control the local Android device. |

Useful flags on full / dast: --window (show the emulator), --guided (drive the app by hand), --username u --password p (test-account login), --out report.json.

What it checks

• Static: decompiled-code weaknesses, insecure manifest/permissions, hardcoded secrets, React Native (Hermes) bundles, and more.
• Dynamic (on a rooted emulator): SSL-pinning bypass + traffic interception, plaintext secrets in storage, exported components, unvalidated deep links, root/emulator detection, insecure backup, sensitive logs, insecure WebViews, debug signing, and client-side storage tampering.

Findings are mapped to OWASP MASVS/MASTG, ranked by severity, each with a suggested fix.

Only scan apps you own

traze refuses to run without an explicit ownership declaration (--i-own-this). Only scan apps you built or are authorized to assess.

Privacy

All analysis runs locally. Downloaded tools live under ~/.traze. Secrets found during a scan (keystore dumps, tokens) stay in memory for the run and are never written to logs — only the findings are kept.

iOS is not supported yet. Android only.