Release APKs
Scan the release .apk produced by your build. Wardix does not scan Android App Bundles (.aab); use the APK your pipeline produces for release testing.
See your app the way attackers do.
The shipped bundle is the real attack surface. Wardix reads Android APKs and developer-exported iOS IPAs straight from the pipeline.
No agent, no SDK, no source upload — the binary is deleted when the scan ends.
example-pipeline.yml — Wardix gate
example
3 new·1 fixed·41 persisting
exit 1 only when this build introduced new findings at or above your threshold
exit 1
Illustrative sample only. The app, findings, and build comparison are fictional; this is not customer material or a scan result.
findings anchored to
OWASP MASVS
MASTG
CWE
SARIF 2.1
— the standards your auditors already read
01 · Why the bundle
Attackers don't read your repo. They read your release.
01
The shipped artifact is rarely analyzed
Multiple teams merge into one bundle. What actually ships — after bundling, codegen and config injection — is the thing nobody inspects.
02
Pentests are snapshots; you ship weekly
An audit once a year describes a build from months ago. Every release between audits ships on trust.
03
Extraction is automated now
A leaked key was never worth six hours of manual reverse engineering. Automated across ten thousand store apps, it is.
Current capability · static analysis
ANDROID
iOS
ONE RELEASE LOOP
For the people shipping mobile apps.
Wardix helps mobile engineering, product security, and release teams review the compiled app that is about to ship. Scan in the pipeline, triage the report, and focus the release gate on findings introduced by the latest build.
Developer-exported IPAs
Scan a development or ad-hoc .ipa exported by your team. Store-downloaded IPAs are encrypted and cannot be analyzed.
Findings with context
Deterministic static analyzers produce findings. Reports show what is new, fixed, or persisting against the previous build of the same app.
Read about the static-analysis alpha
Illustrative sample finding · fictional
HIGH · NEW
Hardcoded API credential in the app bundle
Example of a static finding a team might review. The text and build counts shown on this page are invented and do not come from a Wardix customer scan.
Before you start
Frequently asked questions.
Which files can I scan?
Android release APKs and developer-exported iOS development or ad-hoc IPAs, up to 300 MiB per artifact. Wardix does not scan .aab files or encrypted, store-downloaded IPAs. See the supported builds guide.
Can Wardix run in CI?
Yes. Use the Wardix CLI in your pipeline or the GitHub Action. Each scan compares against the previous build of the same app; the first scan establishes its baseline. See the CLI and GitHub Action guides.
Do I need to provide source code?
No. Wardix scans the compiled APK or IPA artifact. The workflow does not require a source-code upload. The artifact is deleted when the scan ends.
What are the current limitations?
The current alpha provides static analysis only, with a 300 MiB maximum artifact size. Dynamic analysis and GDPR/consent capture are unavailable; Android App Bundles and store-downloaded iOS IPAs are not supported. Dedicated Fastlane, Bitrise, and EAS integrations are also outside the alpha. Read the alpha limitations.
How do I get access?
Company applicants do not need an invitation, but Wardix manually reviews each request before activation. Legacy static-alpha accounts are invitation-based. Registration alone does not activate access. See Getting started.
02 · The release gate
One verdict, where the release decision already happens.
No new dashboard to babysit. The scan passes or fails the pipeline at the severity threshold you set.
pass
no new findings at or above your threshold
exit 0
fail
new findings at or above your threshold
exit 1
Findings below your threshold stay visible without blocking. Dismissals carry forward and export to GitHub code scanning as suppressions.
# .github/workflows/security.yml - uses: wardixio/wardix-scan-action@v1 with: artifact: build/app-release.apk key: ${{ secrets.WARDIX_KEY }} fail-on: critical
Android APK and developer-exported iOS IPA
Attackers automate. So should you.
Connect one app and your next build becomes the baseline. Every release after it gets a diff and a verdict.
manual account approval · first scan becomes the baseline · wardix.io