APK scanning FAQ
Common security questions about how DropAPK reviews Android apps.
What does DropAPK scan when an app is uploaded?
Every APK is streamed and treated as a ZIP archive. We extract AndroidManifest.xml, decode the compiled binary XML, read the package name, and collect every declared permission. Those permissions are compared against lists of sensitive and dangerous permissions such as Camera, Microphone, Location, Contacts, SMS, Phone, and Device admin.
What does the Safe rating mean?
A Safe rating means the manifest scan found no sensitive permissions and no other risk signals. These listings can be approved automatically and shown in the store right away. It does not mean the app is guaranteed harmless — see 'What scanning does not do' below.
Why is an app rated Caution?
Caution means the scan completed cleanly, but the app requests one or more sensitive permissions. Sensitive permissions can access personal data or device features. We show the exact permissions on the app page so you can decide whether the request makes sense for that app.
Why would an app be Flagged?
Flagged apps declare dangerous permissions, unusual package behavior, or other signals that require a human review before they can be listed. Flagged apps do not appear in the store until an admin clears the review queue.
How often are apps rescanned?
A scan runs automatically every time a developer uploads a new APK or replaces an existing build. Admins can also trigger a manual rescan from the review queue at any time. The app page always shows the most recent scan date.
What happens if a scan fails?
If the uploaded file is malformed, encrypted, or cannot be parsed, the scan is recorded as Caution with a failure note. The app is not marked Safe, and it will not be auto-approved until a readable APK is provided.
What scanning does not do
- It does not execute the app or perform runtime behavior analysis.
- It does not scan native code, obfuscated strings, or third-party SDK behavior.
- It does not replace your own judgment — only install apps from developers you trust.
- It does not guarantee that future updates will behave the same way.
- It reads the manifest only; it cannot see what the app actually does at runtime.
Safety rating quick reference
For the full definitions of each rating, visit the Safety page.
Ready to install the store? Get the app or read the FAQ.