Sys 06 · Sigap (own product)
It answers for what the phone installed
AndroidNo root12 checksNo INTERNET
Nobody can tell a bank app from a copy wearing its name. Sigap reads what is installed on the phone itself, with no root and no internet permission: which apps came from outside a store, which ones can read the screen or the notifications, which ones use a bank's name without being installed from a store. Six categories, four attack paths in plain language, and eight things it does not check, printed on the same screen as the findings. The number on the screen is risk points, not a grade: 93 means worse than 21. It asks one permission, QUERY_ALL_PACKAGES, to see the app list. Nothing leaves the phone unless you press share, and it targets API 34, under Play's current floor, so it is handed over as a file rather than through Play. Built and signed on this machine without Gradle. No phone has run it yet, so the screens are a rendering of its layout with sample data, not a capture from a device.
verified id.dewaruci.sigap 2.6, versionCode 8, 78,434 bytes, sha256 929a6b02, zipalign 4 OK, CN=sigap by dewaruci; 12 checks and 8 stated limits counted from the code; built twice, in place and from a copy under another timezone, both 929a6b02; put through MiroFish adversarial review five times.