The App Exposure Check shows you what your published Android or iOS app reveals to anyone who downloads it. An Otukan engineer examines the public store release in Google Play or the App Store, passively and free of charge. We never ask for files, source code or access to your systems. Once we have verified that you act for the app’s publisher, the engineer sends the findings to you by email, with an invitation to walk through them together. It takes four short steps to request, and you start with nothing more than your store link.
Scope
What the engineer looks at
Your app as any user, or any attacker, could download it. The engineer looks at what the release reveals about its code, how visible its protection is from the outside, and what it exposes about the connection to your backend. Google Play and App Store releases are reviewed separately, because each platform exposes different things to an outside observer.
What we never request
Binaries or file uploads, source code, signing keys, API keys or other secrets, credentials or test accounts, production data, and access to your infrastructure. If a request for any of these reaches you in our name, it did not come from this check.
Who may request it
Someone authorised to act for the app’s publisher, using a business email address. Findings about an app go only to its publisher, so requests about apps the requester does not publish, including competitors’ apps, are declined, as are personal requests.
Request
The form has four steps. You can go back at any point, and contact details are asked for only in the last step.
- App. Paste the Google Play and/or App Store link. The platform is taken from the link. If your app is not in a store yet, the form takes you to a technical conversation instead; no files are requested there either.
- Context. Your industry, your build stack (native Android or iOS, Flutter, React Native, Unity or other) and any protection you already use.
- Primary concern. One or more of: reverse engineering and IP, tampering and repackaging, root, jailbreak and hooking, fraud and account takeover, API abuse and bots, malware and overlay, pentest findings and compliance, game cheating.
- Contact and authorisation. Your name, business email, company and role, confirmation that you are authorised to request this for the publisher, and our privacy notice.
Result
After you submit, a confirmation screen explains what happens next and an acknowledgement email follows.
- Publisher verification. We check your email domain against the publisher listed in the store. If they do not match, we verify manually.
- Analysis. An Otukan engineer reviews the public store release, focusing on the concerns you selected.
- Findings by email. The engineer’s findings go only to the verified publisher contact. The email ends with an invitation to an optional technical walkthrough and demo with Otukan’s application security engineers, where you see what the findings mean for your app and how Otukan protects against them.
The check is a focused outside-in view of your published app. It complements a penetration test, a certification or a compliance attestation rather than replacing them, and it gives your team a clear, practical starting point for the conversation about protection.