APK Sentinel project description

Deterministic Android APK triage

APK Sentinel is a Willow & Birdie research product for evidence-backed static analysis of Android application packages.

The intended service workflow accepts one APK and produces a bounded, versioned JSON triage report. Current paid availability is unverified; consult product status. The canonical report core is repeatable for the same APK, analyzer version, and rules version. General human/private customer intake remains closed.

Report areas represented in published evidence

• Package metadata and APK identity
• Requested permissions and dangerous combinations
• Exported Android components
• Signing certificate metadata and fingerprints
• Bounded URL, domain, and IP evidence
• Suspicious API indicators with source references
• Structured findings with severity and category
• A deterministic rule-based risk score

Explicit non-goals

• No APK installation or execution
• No dynamic analysis in the current MVP
• No URL-based APK ingestion
• No sample retention as a product feature
• No VirusTotal dependency or sample resale
• No LLM-generated core scoring

The project is not a guarantee that an APK is safe or malicious. Static analysis can miss encrypted, downloaded, environment-triggered, or runtime-only behavior.