zuhayrb/dexpose

Pure-Go CLI that scans APK files for leaked secrets. Zero dependencies, gitleaks-compatible rules, CI-friendly exit codes. - zuhayrb/dexpose

5 stars · 0 forks · Go Topics: android, golang, security, ci, static-analysis, secrets, apk, devsecops, leaked-secrets

README

Dexpose

A pure-Go CLI tool that scans APK files for leaked secrets and sensitive strings. No JVM, no jadx, no runtime dependencies — just a single static binary. ██████╗ ███████╗██╗ ██╗██████╗ ██████╗ ███████╗███████╗ ██╔══██╗██╔════╝╚██╗██╔╝██╔══██╗██╔═══██╗██╔════╝██╔════╝ ██║ ██║█████╗ ╚███╔╝ ██████╔╝██║ ██║███████╗█████╗ ██║ ██║██╔══╝ ██╔██╗ ██╔═══╝ ██║ ██║╚════██║██╔══╝ ██████╔╝███████╗██╔╝ ██╗██║ ╚██████╔╝███████║███████╗ ╚═════╝ ╚══════╝╚═╝ ╚═╝╚═╝ ╚═════╝ ╚══════╝╚══════╝

dexpose v0.4.0 — 57 rules loaded

dexpose: scanning target.apk dexpose: classes.dex: 14203 strings extracted dexpose: found AKIAIOSFODNN7EXAMPLE in classes.dex [aws-access-key] dexpose: found AIzaSyBlL7MI-FuPJ3EueRrfB2ClDXFwkwoQrSg in AndroidManifest.xml [google-api-key] dexpose: target.apk: 2 finding(s) dexpose: scanned 1 APK(s), 2 finding(s)

Install go install github.com/zuhayrb/dexpose@latest Or download a pre-built binary from Releases:

Linux (amd64)

curl -sL https://github.com/zuhayrb/dexpose/releases/latest/download/dexpose_linux_amd64.tar.gz \ | tar xz

macOS (arm64)

curl -sL https://github.com/zuhayrb/dexpose/releases/latest/download/dexpose_darwin_arm64.tar.gz \ | tar xz Usage

Scan a single APK

dexpose target.apk

Scan a directory of APKs, output as JSON

dexpose -f json -o results.json ./apks/

Show match context and real-time scan details

dexpose --context --verbose target.apk

Custom patterns + ignore file

dexpose -p my-rules.toml -i .dexposeIgnore target.apk

Print version

dexpose --version

Enable verbose output

dexpose -v target.apk Flags

Flag Shorthand Description

--format -f Output format: plain (default) or json

--output -o Write results to file instead of stdout

--patterns -p Path to custom rules.toml

--ignore -i Path to ignore file

--context -c Include surrounding characters around each match

--verbose -v Print scan progress and per-file metadata

--quiet -q Suppress non-fatal stderr output

--version

Print version information and exit

Output formats Plain (default) — tab-separated lines: target.apk classes.dex aws-access-key AKIAIOSFODNN7EXAMPLE target.apk AndroidManifest.xml google-api-key AIzaSyBlL7MI-FuPJ3EueRrfB2ClDXFwkwoQrSg target.apk assets/config.json jwt-token eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U

JSON — structured array, pipeable into jq: dexpose -f json target.apk | jq '.[].pattern' [ { "apk": "target.apk", "source": "classes.dex", "pattern": "aws-access-key", "match": "AKIAIOSFODNN7EXAMPLE" }, { "apk": "target.apk", "source": "AndroidManifest.xml", "pattern": "google-api-key", "match": "AIzaSyBlL7MI-FuPJ3EueRrfB2ClDXFwkwoQrSg" } ] CI usage Exit code 1 when findings exist, 0 when clean: dexpose -f json -o results.json ./release.apk && echo "clean" || echo "secrets found" Ignoring false positives Create a .dexposeIgnore file: [[ignore]] pattern = "generic-api-key"

[[ignore]] value = "AKIAIOSFODNN7EXAMPLE"

[[ignore]] source = "assets/vendor.bundle.js" Suppressed findings are excluded from both output and exit code. What it scans Within each APK, dexpose inspects:

DEX files — classes.dex, classes2.dex, etc. (individual strings extracted from the DEX string table) AndroidManifest.xml — decoded from binary XML format; resource ID references (e.g. @0x7F010000) are resolved to their string values via resources.arsc when available res/values/strings.xml — plain XML scan (present in debug APKs) resources.arsc — compiled binary resource table scanned for string-type entries (present in all APKs; is the primary source of string values in release APKs where strings.xml is stripped) assets/ — all files scanned as plaintext

Patterns Ships with 57 rules covering AWS, Stripe, Slack, Twilio, SendGrid, Mailgun, Google, GitHub, Heroku, DigitalOcean, Azure, Datadog, Terraform Cloud, Shopify, Firebase, JWT tokens, and more. Uses gitleaks-compatible rules.toml format — drop in your own gitleaks config with --patterns. Exit codes

Code Meaning

0 No findings

1 One or more findings present

2 Scan error

Development make build # sync patterns + compile make test # run tests with race detector make lint # go vet + staticcheck make tidy # go mod tidy + verify make snapshot # local GoReleaser dry run make sync # copy patterns for go:embed Security Verify downloaded binaries against the SHA-256 checksums published with each release: sha256sum dexpose cat checksums.txt Support ☕ If you find dexpose useful, consider supporting development:

BTC: bc1qarlskqtdq4wsdudecktv6g7zqv5jv52at9k5uk ETH/ERC-20: 0x03d42691a1f0d9af62899813e1f3937da0f6039b SOL/SLP: J9jneBCAW8NaoSj5KekxLyxBcYbzNq3F2Wshdar7FHdf

License MIT License — see LICENSE for details.

source

zuhayrb/dexpose: Pure-Go CLI that scans APK files for leaked secrets. Zero dependencies, gitleaks-compatible rules, C