.png)
LogDrop Taint Analysis
Data-flow security analysis for iOS, Swift, Android, Kotlin, and Java source code
LogDrop Taint follows user-controlled, personal, credential, and secret data through your mobile source code and reports dangerous flows that reach a sink without the right sanitisation.
It also includes focused checks for hardcoded credentials and unsafe platform network configuration.
The analyzers run locally and emit the same SARIF 2.1.0 report shape. Teams shipping both iOS and Android apps get one kind of finding, a shared .logdrop.json configuration format, and one signed suppressions format.
Your repository stays local
The analyzers open no network connection and never upload your repository. A SARIF report contains finding metadata, file paths, locations, and the relevant data-flow trace; by default it also contains the offending line with two lines of context on either side. If you optionally send that report to LogDrop, those snippets are sent with it. Set snippets: "false" to remove every source snippet before saving or sending the report.
Choose a platform
iOS / Swift
Run data-flow analysis on macOS 15+ with the LogDrop Taint GitHub Action or standalone executable.
Android / Kotlin & Java
Run data-flow analysis on JVM 17+ with the LogDrop Taint Android Action or standalone JAR.
Shared security coverage
| Scenario | CWE |
|---|---|
| Unsanitised user or network data reaches a WebView | CWE-79 |
| Untrusted data is interpolated into a SQL query | CWE-89 |
| Personal data is written to a log | CWE-532 |
| Personal data is stored locally in clear text | CWE-312 |
| An API key, token, or secret is written directly into source | CWE-798 |
| A hardcoded key reaches a cryptographic API | CWE-321 |
| Personal data or credentials reach the system clipboard | CWE-200 |
| Untrusted data is built into a predicate or selection clause | CWE-943 |
| The app globally permits cleartext network traffic | CWE-319 |
Where findings appear
- Pull request: an inline annotation above the relevant line in Files changed.
- Job summary: a location, rule, and finding table on the workflow run.
- CI gate: enable
fail-on-findingsto block a merge when findings exist. - Code Scanning: upload standard SARIF when the repository has Code Scanning enabled.
Panel reporting is optional and off by default. Without panel-url, the scan and its report stay entirely local.