APK Sentinel security

Scope

APK Sentinel is designed as bounded static APK triage. The documented product boundary is:

APK files are treated as untrusted input.
The analyzer does not install or execute APKs.
Extracted URLs and domains are evidence only; the static analyzer does not fetch them as part of this showcase.
Results are structured, schema-versioned JSON with evidence and explicit limitations.
The public documentation site accepts no APK uploads and exposes no customer intake endpoint.

Authorized use

Only submit APKs that you are authorized to analyze. Do not send credentials, private keys, tokens, personal data, or customer artifacts through the public documentation site or the contact mailbox.

Reporting a security issue

Send a concise report to admin@willowbirdie.com. Do not include secrets or live customer samples. Describe the affected public URL, impact, reproduction steps, and a safe test fixture where possible.

This page is a product security boundary, not a guarantee that every deployment has identical controls. Deployment-specific isolation, retention, payment, availability, and incident-response terms must be confirmed for the deployment being used.

Named endpoint: unresolved operational guarantees

For api.willowbirdie.com, deletion deadlines, failure-retention windows, sample-metadata logging, data residency, and support response times have not been reverified for current public use. Ephemeral processing is a design intent, not a time-bound deletion guarantee. The current availability record therefore does not authorize private intake.