The bytecode never leaves your phone.
AppXpose unpacks the APK file directly through the Android Package Manager and reads its DEX classes in-process. Class names, method calls, and obfuscation patterns are matched against a growing database of curated tracker signatures, without ever uploading a single byte. The actual analysis happens in the same place the malware would: on your device.
"We can't leak what we never had."
Not just what trackers are there. Why they matter.
Every scan triggers an LLM-powered analysis that goes far beyond tracker lists. You get a full paywall and monetization breakdown (is this app pay-to-win?), a developer profile (company, server locations, GDPR posture), data-sharing probability estimates (who gets your Advertising ID and why), and natural-language explanations next to every finding. The AI sees the pre-score, the permissions, the trackers, and the breach history, and writes you a report a human would understand.
"The receipts, translated."
Five systems. Server + on-device. If one flags it, you know.
Five systems working together. MalwareBazaar and Koodous check every APK hash against two independent malware databases in parallel. AppXpose CertNet, our crowd-sourced database of 4,700+ verified signing certificates, catches repackaged APKs by comparing certs. Community APK Hash Verification cross-references your hash against what other users report - once 7+ devices agree, any deviation is flagged. And on your device, the APK Integrity Checker inspects DEX headers, signing blocks, native libraries, and file structures for hooking frameworks, root tools, debug artifacts, and repackaging indicators. If any of the five flags something, you know.
"Five locks, one door."
Developer history checked, future risk predicted.
For every app scanned by any AppXpose user, our server checks the developer's domain against the Have I Been Pwned breach database. The AI then forecasts future risk based on breach history, data practices, and developer reputation. GUARD subscribers are checked automatically every 24 hours. When a new breach is detected, every GUARD user with that app installed gets notified, even if they never scanned it themselves.
"The forecast is the warning."
Context-aware. A weather app asking for contacts scores differently than a messenger.
Every permission is mapped to a plain-language explanation, ranked by risk class (normal, dangerous, signature, special), and compared against previous results when available. The scoring is context-aware across 45 Play Store categories. A navigation app with location access scores 0. A flashlight app with the same permission scores higher. GUARD subscribers get automatic alerts when an app silently adds new permissions after an update.
"Permissions you can read."
You stop checking. We don't.
GUARD combines community intelligence with local monitoring. Breach alerts and tracker change detection are powered by the community: when any user scans an app, the results are compared server-side and all GUARD users with the same app benefit. Permission changes, app removals, and developer certificate changes are monitored locally on your device every 24 hours.
"Five sentries. One command center."
Anonymous votes, profanity-filtered, no algorithm games.
Other AppXpose users have already scanned the apps you have installed. Their scores, comments, and warnings are pinned next to the technical results. There are no follower counts, no engagement loops, just signal from people who came to the same question you did.
"Wisdom of the cautious."
Your phone, documented.
Every scan you run is saved to a local database: risk scores, tracker lists, permission audits, all timestamped. The App Index lets you browse, search, and compare your installed apps in one place. Filter by risk level, sort by last scan date, spot which apps got worse over time. It turns scattered scans into a structured record of what is running on your device.
"Infrastructure, not a feature."
Five detection systems are live in production and actively learning from every scan. MalwareBazaar and Koodous check APK hashes against two independent malware databases, CertNet and Community Hash Verification catch repackaged APKs through crowd-sourced baselines, and the on-device APK Integrity Checker inspects file structures for hooking, root tools, debug artifacts, and packer signatures. Two additional ML models are in training on that growing corpus.
