{'fraction_non_alphanumeric': 0.017391304347826087, 'fraction_numerical': 0.0, 'mean_word_length': 5.531914893617022, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Finding architectural flaws in android apps is easy

Mobile devices store confidential information. As a result, security vulnerabilities such as information disclosure in mobile apps can have serious consequences. To build secure apps, developers are expected to follow security policies that are described only informally. Some policies target architectural flaws, rather than coding defects, and are not easily checked or enforced with existing tools. Scoria is a prototype tool that allows architects to write security policies as machine-checkable constraints that are executed against a program abstraction that is a hierarchy of abstract objects with dataflow communication edges. Using Scoria, architects reason not only about the presence or absence of communication, but also about object provenance, hierarchy and reachability. We show how Scoria can find information disclosure in an open-source Android app.