SAST identified vulnerabilities fixable by Quixxi Shield
Note: Only the vulnerabilities that are marked as "Fixable by Quixxi" can be fixed after Quixxi Shield integration (Refer below image)
In order to fix those vulnerabilities, you need to Toggle(on/off) respective shield configurations during app shielding (Configuration screen below)
To eliminate the identified vulnerabilities, please follow the below table:
Note: This reference table helps to point out which security setting to enable for eliminating the vulnerabilities identified by SAST scan.
| For Android - APK | ||
| S.No | SAST SCAN Vulnerability Identified By Quixxi | Make sure you enable the following option during App Shielding |
| 1 | Protection of text fields from copying the text and paste outside your app | Disable Copy & Paste Functionality |
| 2 | Outputting Logs to Logcat / Logging Sensitive Information | Enable to remove logs used in the application |
| 3 | Certificate Pinning | SSL certification validation / SSL pinning |
| 4 | Emulator Detection Check | Terminate app when the app is connected to Emulator |
| 5 | Check for Usage of Native(C, C++) Code | Automatically Fixed by Quixxi |
| 6 | Is App Debuggable | Automatically Fixed by Quixxi |
| 7 | Usage of Installer verification code | Automatically Fixed by Quixxi |
| 8 | Protection of app screens by blurring when the app is running in background | Disable Screenshots & Screen sharing Functionality |
| 9 | Protection of capturing screenshots & sharing screens outside your app | Disable Screenshots & Screen sharing Functionality |
| 10 | Executing "root" or System Privilege Check | Terminate app when the app is running in rooted device |
| For iOS - iPA | ||
| S.No | SAST SCAN Vulnerability Identified By Quixxi | Make sure you enable the following option during App Shielding |
| 1 | Certificate Pinning check | SSL certificate validation via SSL pinning |
| 2 | Protect the app from screen sharing | Screen Protection |
| 3 | Protection of text fields from copy and paste outside your app | Disable Copy & Paste functionality on text fields |
| 4 | Jailbroken check | Terminate the app running in jailbroken phones |
| 5 | Unencrypted user defaults | Encrypt App Preferences stored using UserDefaults |
| 6 | Unencrypted local runtime files | Encrypt files created by the application at runtime |
For any other clarifications, you can always mail to [email protected]