Shifting Mobile Security Left: Applying SAST to Android Apps with MobSF

The Victim: A Vulnerable Android App
For this test, I uploaded an open-source vulnerable Android application (similar to InsecureBankv2). Instead of executing the app, MobSF decompiles it and runs its SAST ruleset against the extracted source.

Within 60 seconds, the dashboard populated with critical findings. Here are the two most dangerous vulnerabilities caught by the static scan:

1. Hardcoded Secrets (CWE-798)
MobSF flagged the res/values/strings.xml file. A developer left a production AWS access key directly in the code:

<!-- Flagged by MobSF: Hardcoded sensitive information --> <string name="aws_access_key">AKIAIOSFODNN7EXAMPLE</string> Why it matters: Anyone who downloads the app from the Play Store can use a tool like Apktool to extract this string in seconds. 

2. Insecure Data Storage (CWE-312)
The analyzer traced a data flow in the Kotlin backend where user session tokens were being saved using SharedPreferences without the EncryptedSharedPreferences wrapper.

// Flagged by MobSF: Insecure SharedPreferences implementation val sharedPref = activity?.getPreferences(Context.MODE_PRIVATE) with (sharedPref.edit()) { putString("session_token", userToken) // Tainted data sink apply() } 

Why it matters: If the device is rooted, MODE_PRIVATE does not protect the XML file from being read by other malicious applications on the device. Secure storage is a non-functional requirement that must be enforced at the architectural level.

The Next Evolution: Bringing SAST to the IDE
While running a Dockerized SAST tool is great for CI/CD pipelines, the feedback loop can be tightened even further.

The future of SAST isn’t just in dashboards; it’s in the developer’s immediate workspace. The ultimate goal is to transform tools like these into VS Code extensions or AI-assisted IDE plugins. By bringing the vulnerability analyzer directly into the code editor as a language server “skill”, developers receive inline warnings the exact moment they type a hardcoded secret or implement an insecure storage method.

Conclusion
Mobile applications require specialized security tooling. By leveraging MobSF’s static analysis capabilities, we found critical data storage and hardcoded secret vulnerabilities without ever launching an emulator. Automating this process ensures that fundamental security requirements are met before a single line of code reaches production.

Demo repository (code + CI workflow): https://github.com/GianfrancoArocutipa/psalm-sast-demo(#)