SearchLightPro — Security scans

Automated static scans of the SearchLightPro 1.0.0 Android package (com.spaces.inventory), the same build published on Google Play. These are not a lab pentest and not a privacy certification.

εxodus Privacy

The public εxodus website cannot analyze paid Play Store apps. It downloads packages from Google Play or F-Droid, and it cannot buy SearchLightPro. That is a limitation of their crawler, not a finding about the app.

The same scanner was run locally with εxodus-standalone on the Play APK. Result:

Trackers	0
Permissions	`CAMERA`; AndroidX non-exported receiver permission
Libraries listed by εxodus	None
APK SHA-256	`8e785591168d0755f38fd9cd623b74969db5709e7feabc5b33ebb4d259b8d80e`
Raw JSON	exodus.json

Trackers

Permissions

CAMERA; AndroidX non-exported receiver permission

Libraries listed by εxodus

None

APK SHA-256

8e785591168d0755f38fd9cd623b74969db5709e7feabc5b33ebb4d259b8d80e

Raw JSON

exodus.json

Anyone with the APK can reproduce this: docker run --rm -v /path/to/SearchLightPro-1.0.0.apk:/app.apk exodusprivacy/exodus-standalone

MobSF static scan

MobSF scored the APK 53 / 100. That score is mostly from minSdk 24 (Android 7). The scan found no trackers and no INTERNET permission. SearchLightPro code under com.searchlight had no MobSF code-analysis hits.

Package

App	SearchLightPro 1.0.0 (versionCode 1)
Package	`com.spaces.inventory`
File	`SearchLightPro-1.0.0.apk`
SHA-256	`8e785591168d0755f38fd9cd623b74969db5709e7feabc5b33ebb4d259b8d80e`
minSdk / targetSdk	24 / 36
Scanner	MobSF v4.5.4, static APK analysis, 1 October 2026

App

SearchLightPro 1.0.0 (versionCode 1)

Package

com.spaces.inventory

File

SearchLightPro-1.0.0.apk

SHA-256

8e785591168d0755f38fd9cd623b74969db5709e7feabc5b33ebb4d259b8d80e

minSdk / targetSdk

24 / 36

Scanner

MobSF v4.5.4, static APK analysis, 1 October 2026

Privacy-relevant results

Trackers	0 of 432 in MobSF’s database
INTERNET permission	Not requested
Network security findings	None
Firebase / ads / analytics SDKs	None found
App-contacted URLs	None (string hits were Android/OpenCV schema URLs in libraries)
Permissions	`CAMERA` (user-granted). Plus an AndroidX signature permission for non-exported receivers.
Backup	`allowBackup` is false

Trackers

0 of 432 in MobSF’s database

INTERNET permission

Not requested

Network security findings

None

Firebase / ads / analytics SDKs

None found

App-contacted URLs

None (string hits were Android/OpenCV schema URLs in libraries)

Permissions

CAMERA (user-granted). Plus an AndroidX signature permission for non-exported receivers.

Backup

allowBackup is false

What MobSF flagged

Severity	Finding	Notes
High	Installable on Android 7.0 (`minSdk=24`)	MobSF prefers minSdk 29+. This is a support-range choice, not a tracker or network issue.
Warning	Exported `ProfileInstallReceiver`	Ships with AndroidX Baseline Profiles. Guarded by the platform `DUMP` permission. Not SearchLightPro app code.
Warning	Weak RNG / raw SQLite / “hardcoded secrets”	Hits were in bundled libraries (including OpenCV), not in `com.searchlight`. The “secrets” list was digit alphabets and library constants, not API keys.
Hotspot	`CAMERA`	Required to take baseline and check photos. Used only when you start a capture.
Secure	No privacy trackers	MobSF marked this as a secure finding.

Severity

Finding

Notes

High

Installable on Android 7.0 (minSdk=24)

MobSF prefers minSdk 29+. This is a support-range choice, not a tracker or network issue.

Warning

Exported ProfileInstallReceiver

Ships with AndroidX Baseline Profiles. Guarded by the platform DUMP permission. Not SearchLightPro app code.

Warning

Weak RNG / raw SQLite / “hardcoded secrets”

Hits were in bundled libraries (including OpenCV), not in com.searchlight. The “secrets” list was digit alphabets and library constants, not API keys.

Hotspot

CAMERA

Required to take baseline and check photos. Used only when you start a capture.

Secure

No privacy trackers

MobSF marked this as a secure finding.

Signing

APK Signature Scheme v2, RSA-2048 / SHA-256. Certificate CN=SearchLight, O=SearchLight, C=US. Valid 5 September 2026 through 21 January 2054. Certificate SHA-256: 8dc973c8cac452fcf12eaba9454d2a04572bd435f60fb2f2c8a9234b52c392fd

Limits

Static analysis only. No dynamic (runtime) test.

MobSF scores generic Android hygiene. A low score here is not the same as “the app phones home.”

This is not an independent lab audit (Cure53, OSTIF, and similar programs were not used).

Anyone can reproduce it: scan the Play APK whose SHA-256 matches the hash above with εxodus-standalone or MobSF v4.5.4.