amanirenas

Offline mobile app security assessment from the terminal. Analyze app packages (IPA/APK/AAB) for hardcoded secrets, weak cryptography, insecure endpoint usage and WebView posture — without a device, an emulator or live runtime access.

Guarantees

  • Offline by design — analyzes only the app package you point it at; live runtime/device collection is refused honestly
  • Six-stage pipeline: intake, metadata, static analysis, configuration, API endpoints and evidence-backed findings
  • Deterministic rule engine (AMN-001+) — a rule is a pure function of the read-only environment
  • Risk scores are transparent: severity_weight × confidence × exposure, capped at 100

Install

git clone --depth 1 https://github.com/QYVORA/qyvora-amanirenas && cd qyvora-amanirenas && go build ./cmd/amanirenas

Usage

  • amanirenas assess --sim
  • amanirenas package --output app.json
  • amanirenas assess --package app.json
  • amanirenas findings
  • amanirenas evidence
  • amanirenas report -f json --out report.json