APK safety scanning
How DropAPK reviews every upload before it reaches the store.
What the ratings mean
Each app listing shows a safety badge based on its most recent APK scan.
Safe
No sensitive permissions or suspicious findings.
The APK was unpacked, its manifest parsed, and no dangerous permissions or other risk signals were found. Apps rated Safe can be auto-approved for the store.
Caution
Clean scan, but requests sensitive permissions.
No malware or dangerous behavior was detected, but the app declares permissions that can access personal data or device features. Read the listed permissions before installing.
Flagged
The scan found something worth reviewing.
The build declares dangerous permissions, unusual package behavior, or other signals that require human review. Flagged apps do not appear in the store until an admin clears them.
Unscanned
Scanning has not finished or failed.
A scan may still be running, or the uploaded file could not be parsed. Unscanned apps are not listed for download.
What the scanner checks
The scan runs automatically when a developer uploads a new APK or when an admin requests a rescan.
Manifest extraction
Every upload is streamed as a ZIP archive. We locate AndroidManifest.xml without downloading the whole file to disk.
Binary XML decoding
AndroidManifest.xml is stored in a compiled binary format. Our parser decodes it back into readable strings, namespaces, and attributes.
Package name verification
We read the package attribute so the store page matches the actual APK identity and can detect mismatched uploads.
Permission analysis
All declared uses-permission entries are collected and compared against a list of sensitive permissions such as Camera, Microphone, Location, Contacts, SMS, and Device admin.
Risk scoring
The app is scored based on the permissions it requests and any declared findings. Safe builds have no sensitive permissions or findings; Caution builds have sensitive permissions only; Flagged builds have dangerous signals.
Store update
Scan results are written to the app's store record, including the scan date, detected permissions, and reviewer notes. The safety badge on the app page reflects the latest scan.
What scanning does not do
- It does not replace your own judgment — only install apps you trust.
- It does not execute the app or perform runtime behavior analysis.
- It does not guarantee that future updates will behave the same way.
Want to install the DropAPK launcher? Get the app or read the FAQ.