MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
This report presents the forensic synthetic code analysis of mvt-project/mvt, a Python project with 12,693 GitHub stars. SynthScan v2.0 examined 28,608 lines of code across 256 source files, recording 319 pattern matches distributed across 14 syntactic categories. The overall adjusted score of 17.5 places this repository in the Moderate AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 319 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/mvt/ios/cli.py | 84 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 86 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/ios/cli.py | 108 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/ios/cli.py | 110 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/ios/cli.py | 116 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/ios/cli.py | 118 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 150 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 152 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 223 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 225 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 265 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 267 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 333 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 335 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 399 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 401 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 444 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/ios/cli.py | 446 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 80 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 82 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/android/cli.py | 104 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/android/cli.py | 106 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/android/cli.py | 112 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/android/cli.py | 114 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/android/cli.py | 146 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/android/cli.py | 148 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/android/cli.py | 158 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/android/cli.py | 160 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 220 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 222 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 290 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 292 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 371 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 373 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 450 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 452 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 497 | # ============================================================================== | COMMENT |
| MEDIUM | src/mvt/android/cli.py | 499 | # ============================================================================== | COMMENT |
| MEDIUM⚡ | src/mvt/android/modules/intrusion_logs/base.py | 330 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | src/mvt/android/modules/intrusion_logs/base.py | 332 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | src/mvt/android/modules/intrusion_logs/base.py | 342 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | src/mvt/android/modules/intrusion_logs/base.py | 344 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | src/mvt/android/modules/intrusion_logs/base.py | 389 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | src/mvt/android/modules/intrusion_logs/base.py | 391 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/mvt/android/modules/intrusion_logs/base.py | 71 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/mvt/android/modules/intrusion_logs/base.py | 73 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/mvt/android/modules/intrusion_logs/base.py | 84 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/mvt/android/modules/intrusion_logs/base.py | 86 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/mvt/android/modules/intrusion_logs/base.py | 157 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/mvt/android/modules/intrusion_logs/base.py | 159 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/mvt/android/modules/intrusion_logs/base.py | 247 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/mvt/android/modules/intrusion_logs/base.py | 249 | # ------------------------------------------------------------------ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_check_android_androidqf.py | 27 | def test_check_encrypted_backup_prompt_valid(self, mocker): | CODE |
| LOW | tests/test_check_android_androidqf.py | 41 | def test_check_encrypted_backup_cli(self, mocker): | CODE |
| LOW | tests/test_check_android_androidqf.py | 56 | def test_check_encrypted_backup_env(self, mocker): | CODE |
| LOW | tests/test_check_android_androidqf.py | 74 | def test_check_malformed_backup_skips_backup_modules(self, tmp_path, caplog): | CODE |
| LOW | tests/test_check_android_adb_removed.py | 12 | def test_check_adb_exits_nonzero(self): | CODE |
| LOW | tests/test_ios_versions.py | 10 | def test_is_ios_version_outdated(self): | CODE |
| LOW | tests/utils.py | 28 | def get_android_backup_folder(): | CODE |
| LOW | tests/test_check_android_backup.py | 20 | def test_check_encrypted_backup_prompt_valid(self, mocker): | CODE |
| LOW | tests/test_check_android_backup.py | 32 | def test_check_encrypted_backup_cli(self, mocker): | CODE |
| LOW | tests/test_check_android_backup.py | 47 | def test_check_encrypted_backup_cli_invalid(self, mocker, caplog): | CODE |
| LOW | tests/test_check_android_backup.py | 60 | def test_check_encrypted_backup_env(self, mocker): | CODE |
| LOW⚡ | tests/test_completion.py | 13 | def test_completion_prints_instructions_by_default(self): | CODE |
| LOW⚡ | tests/test_completion.py | 22 | def test_completion_prints_bash_script(self): | CODE |
| LOW⚡ | tests/test_completion.py | 32 | def test_completion_prints_fish_script(self): | CODE |
| LOW⚡ | tests/test_completion.py | 41 | def test_completion_install_updates_bashrc_once(self, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_completion.py | 62 | def test_completion_install_fish_does_not_update_shell_rc( | CODE |
| LOW | tests/test_custom_modules.py | 43 | def test_load_module_appears_only_for_supported_cli_command(tmp_path): | STRING |
| LOW | tests/test_custom_modules.py | 65 | def test_module_option_runs_supported_custom_module(tmp_path): | STRING |
| LOW | tests/test_custom_modules.py | 91 | def test_custom_modules_load_from_environment_without_cli_flag(tmp_path, monkeypatch): | STRING |
| LOW | tests/test_custom_modules.py | 128 | def test_androidqf_propagates_custom_modules_to_nested_commands(tmp_path, monkeypatch): | STRING |
| LOW | tests/common/test_command.py | 73 | def test_store_alerts_handles_bytes(self, tmp_path): | CODE |
| LOW | tests/common/test_command.py | 86 | def test_modules_run_in_stable_topological_order(self): | CODE |
| LOW | tests/common/test_command.py | 101 | def test_selected_module_runs_transitive_dependencies(self): | CODE |
| LOW | tests/common/test_command.py | 113 | def test_circular_dependency_warns_and_stops(self, caplog): | CODE |
| LOW | tests/common/test_command.py | 132 | def test_unavailable_dependency_warns_and_stops(self, caplog): | CODE |
| LOW | tests/common/test_command.py | 149 | def test_custom_modules_are_filtered_before_ordering(self): | CODE |
| LOW⚡ | tests/common/test_command.py | 161 | def test_selected_custom_module_runs(self): | CODE |
| LOW⚡ | tests/common/test_command.py | 171 | def test_selected_unsupported_custom_module_does_not_run(self): | CODE |
| LOW⚡ | tests/common/test_command.py | 181 | def test_custom_module_dependencies_use_topological_order(self): | CODE |
| LOW⚡ | tests/common/test_utils.py | 32 | def test_convert_mactime_to_iso(self): | CODE |
| LOW⚡ | tests/common/test_utils.py | 35 | def test_convert_unix_to_utc_datetime(self): | CODE |
| LOW⚡ | tests/common/test_utils.py | 41 | def test_convert_datetime_to_iso(self): | CODE |
| LOW⚡ | tests/common/test_utils.py | 45 | def test_convert_timezone_aware_to_iso(self): | CODE |
| LOW | tests/common/test_alerts.py | 9 | def test_as_json_promotes_nested_matched_indicator(): | CODE |
| LOW | tests/common/test_alerts.py | 31 | def test_as_json_removes_nested_matched_indicator_when_parent_exists(): | CODE |
| LOW | tests/common/test_indicators.py | 169 | def test_check_android_property(self, indicator_file): | CODE |
| LOW | tests/common/test_module_loader.py | 41 | def test_load_custom_modules_from_python_file(tmp_path): | STRING |
| LOW | tests/common/test_module_loader.py | 50 | def test_load_custom_modules_from_folder_in_sorted_order(tmp_path): | STRING |
| LOW | tests/common/test_module_loader.py | 64 | def test_discovery_ignores_imported_base_and_unrelated_classes(tmp_path): | STRING |
| LOW⚡ | tests/common/test_module_loader.py | 93 | def test_load_custom_modules_deduplicates_same_class(tmp_path): | STRING |
| LOW⚡ | tests/common/test_module_loader.py | 101 | def test_load_custom_modules_raises_for_missing_path(tmp_path): | STRING |
| LOW⚡ | tests/common/test_module_loader.py | 106 | def test_load_custom_modules_raises_for_import_error(tmp_path): | STRING |
| LOW⚡ | tests/common/test_module_loader.py | 114 | def test_load_custom_modules_loads_env_folder_first(tmp_path, monkeypatch): | STRING |
| LOW | tests/common/test_module_loader.py | 128 | def test_module_supports_command_defaults_to_all_commands(tmp_path): | STRING |
| LOW | tests/common/test_module_loader.py | 136 | def test_module_supports_command_honors_supported_commands(tmp_path): | STRING |
| LOW | tests/android/test_artifact_dumpsys_accessibility.py | 42 | def test_accessibility_service_alert(self): | CODE |
| LOW | tests/android/test_artifact.py | 11 | def test_extract_dumpsys_section(self): | CODE |
| LOW | tests/android/test_artifact_dumpsys_battery_daily.py | 40 | def test_uninstall_and_downgrade_create_medium_alerts(self): | CODE |
| LOW | tests/android/test_artifact_dumpsys_battery_daily.py | 73 | def test_newest_first_update_is_not_reported_as_downgrade(self): | CODE |
| LOW | tests/android/test_artifact_dumpsys_battery_daily.py | 88 | def test_newest_first_downgrade_creates_medium_alert(self): | CODE |
| LOW | tests/android/test_artifact_dumpsys_battery_daily.py | 112 | def test_reinstall_after_uninstall_is_not_reported_as_downgrade(self): | CODE |
| LOW | tests/android/test_intrusion_logs.py | 26 | def test_load_all_events_preserves_unknown_top_level_event(tmp_path): | CODE |
| LOW | tests/android/test_intrusion_logs.py | 52 | def test_check_intrusion_logs_warns_about_unknown_top_level_event_type( | CODE |
| LOW | tests/android/test_intrusion_logs.py | 75 | def test_check_intrusion_logs_parses_core_and_unknown_security_events( | CODE |
| LOW | tests/android/test_intrusion_logs.py | 148 | def test_check_intrusion_logs_treats_event_id_as_security_event_metadata( | CODE |
| LOW | tests/android/test_intrusion_logs.py | 200 | def test_check_intrusion_logs_cli_lists_modules(tmp_path): | CODE |
| LOW | tests/android/test_intrusion_logs.py | 218 | def test_cert_authority_installed_raises_medium_alert_without_indicators(): | CODE |
| LOW | tests/android/test_intrusion_logs.py | 239 | def test_failed_cert_authority_install_does_not_alert(success, caplog): | CODE |
| LOW | tests/android/test_intrusion_logs.py | 258 | def test_cert_validation_failure_raises_medium_alert_without_indicators(): | CODE |
| LOW | tests/android/test_intrusion_logs.py | 273 | def test_security_heuristics_fire_when_no_indicators_loaded(): | CODE |
| 54 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/mvt/ios/modules/fs/webkit_safariviewservice.py | 0 | this module looks extracts records from webkit indexeddb folders, and checks them against any provided list of suspiciou | STRING |
| HIGH | src/mvt/ios/modules/fs/webkit_localstorage.py | 0 | this module looks extracts records from webkit indexeddb folders, and checks them against any provided list of suspiciou | STRING |
| HIGH | src/mvt/ios/modules/fs/webkit_indexeddb.py | 0 | this module looks extracts records from webkit indexeddb folders, and checks them against any provided list of suspiciou | STRING |
| HIGH | src/mvt/android/modules/bugreport/fs_timestamps.py | 0 | this module extracts records from battery daily updates. | STRING |
| HIGH | …mvt/android/modules/bugreport/dumpsys_battery_daily.py | 0 | this module extracts records from battery daily updates. | STRING |
| HIGH | src/mvt/android/modules/bugreport/dumpsys_dbinfo.py | 0 | this module extracts records from battery daily updates. | STRING |
| HIGH | …t/android/modules/bugreport/dumpsys_battery_history.py | 0 | this module extracts records from battery daily updates. | STRING |
| HIGH | src/mvt/android/modules/bugreport/tombstones.py | 0 | this module extracts records from battery daily updates. | STRING |
| HIGH | src/mvt/android/modules/bugreport/dumpsys_packages.py | 0 | this module extracts details on receivers for risky activities. | STRING |
| HIGH | src/mvt/android/modules/bugreport/dumpsys_activities.py | 0 | this module extracts details on receivers for risky activities. | STRING |
| HIGH | src/mvt/android/modules/bugreport/dumpsys_receivers.py | 0 | this module extracts details on receivers for risky activities. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/mvt/ios/modules/net_base.py | 183 | CODE | |
| LOW | src/mvt/ios/modules/base.py | 107 | CODE | |
| LOW | src/mvt/ios/modules/base.py | 186 | CODE | |
| LOW | …c/mvt/ios/modules/mixed/webkit_session_resource_log.py | 69 | CODE | |
| LOW | …c/mvt/ios/modules/mixed/webkit_session_resource_log.py | 177 | CODE | |
| LOW | src/mvt/ios/modules/mixed/interactionc.py | 282 | CODE | |
| LOW | src/mvt/ios/modules/mixed/calendar.py | 87 | CODE | |
| LOW | src/mvt/ios/modules/mixed/safari_browserstate.py | 60 | CODE | |
| LOW | src/mvt/ios/modules/mixed/safari_browserstate.py | 87 | CODE | |
| LOW | …t/ios/modules/mixed/webkit_resource_load_statistics.py | 75 | CODE | |
| LOW | …t/ios/modules/mixed/webkit_resource_load_statistics.py | 147 | CODE | |
| LOW | src/mvt/ios/modules/mixed/tcc.py | 103 | CODE | |
| LOW | src/mvt/ios/modules/fs/analytics.py | 85 | CODE | |
| LOW | src/mvt/ios/modules/fs/shutdownlog.py | 76 | CODE | |
| LOW | src/mvt/common/alerts.py | 40 | CODE | |
| LOW | src/mvt/common/alerts.py | 175 | CODE | |
| LOW | src/mvt/common/log.py | 39 | CODE | |
| LOW | src/mvt/common/indicators.py | 58 | CODE | |
| LOW | src/mvt/common/indicators.py | 114 | CODE | |
| LOW | src/mvt/common/indicators.py | 217 | CODE | |
| LOW | src/mvt/common/utils.py | 206 | CODE | |
| LOW | src/mvt/android/cmd_check_androidqf.py | 263 | CODE | |
| LOW | src/mvt/android/cmd_check_backup.py | 120 | CODE | |
| LOW | src/mvt/android/artifacts/tombstone_crashes.py | 148 | CODE | |
| LOW | src/mvt/android/artifacts/tombstone_crashes.py | 208 | CODE | |
| LOW | src/mvt/android/artifacts/dumpsys_packages.py | 63 | CODE | |
| LOW | src/mvt/android/artifacts/mounts.py | 40 | CODE | |
| LOW | src/mvt/android/artifacts/dumpsys_battery_history.py | 26 | CODE | |
| LOW | src/mvt/android/artifacts/settings.py | 63 | CODE | |
| LOW | src/mvt/android/artifacts/dumpsys_appops.py | 43 | CODE | |
| LOW | src/mvt/android/artifacts/dumpsys_appops.py | 86 | CODE | |
| LOW | src/mvt/android/artifacts/dumpsys_receivers.py | 20 | CODE | |
| LOW | src/mvt/android/parsers/backup.py | 198 | CODE | |
| LOW | src/mvt/android/modules/androidqf/aqf_files.py | 85 | CODE | |
| LOW | src/mvt/android/modules/androidqf/aqf_files.py | 121 | CODE | |
| LOW | src/mvt/android/modules/androidqf/aqf_packages.py | 48 | CODE | |
| LOW | src/mvt/android/modules/intrusion_logs/connect_event.py | 33 | CODE | |
| LOW | …c/mvt/android/modules/intrusion_logs/security_event.py | 304 | CODE | |
| LOW | …c/mvt/android/modules/intrusion_logs/security_event.py | 465 | CODE | |
| LOW | src/mvt/android/modules/intrusion_logs/dns_event.py | 33 | CODE | |
| LOW | src/mvt/android/modules/intrusion_logs/base.py | 123 | CODE | |
| LOW | src/mvt/android/modules/intrusion_logs/base.py | 141 | CODE | |
| LOW | src/mvt/android/modules/intrusion_logs/base.py | 161 | CODE | |
| LOW | src/mvt/android/modules/intrusion_logs/base.py | 251 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/android_androidqf/test_mounts.py | 50 | except Exception: | CODE |
| LOW | src/mvt/ios/decrypt.py | 126 | except Exception as exc: | CODE |
| LOW | src/mvt/ios/decrypt.py | 176 | except Exception as exc: | CODE |
| LOW | src/mvt/ios/decrypt.py | 232 | except Exception as exc: | CODE |
| LOW | src/mvt/ios/decrypt.py | 263 | except Exception as exc: | CODE |
| LOW | src/mvt/ios/modules/base.py | 155 | except Exception as exc: | CODE |
| LOW | …c/mvt/ios/modules/mixed/webkit_session_resource_log.py | 146 | except Exception: | CODE |
| LOW | …c/mvt/ios/modules/mixed/webkit_session_resource_log.py | 153 | except Exception: | CODE |
| LOW | src/mvt/ios/modules/mixed/safari_history.py | 73 | except Exception: | CODE |
| LOW | src/mvt/ios/modules/mixed/safari_history.py | 83 | except Exception: | CODE |
| LOW | …t/ios/modules/mixed/webkit_resource_load_statistics.py | 161 | except Exception as exc: | CODE |
| LOW | src/mvt/ios/modules/backup/manifest.py | 116 | except Exception: | CODE |
| LOW | src/mvt/ios/modules/backup/manifest.py | 186 | except Exception: | CODE |
| LOW | src/mvt/ios/modules/backup/configuration_profiles.py | 142 | except Exception: | CODE |
| LOW | src/mvt/ios/modules/fs/filesystem.py | 88 | except Exception: | CODE |
| LOW | src/mvt/ios/modules/fs/filesystem.py | 100 | except Exception: | CODE |
| LOW | src/mvt/ios/modules/fs/shutdownlog.py | 111 | except Exception: | CODE |
| LOW | src/mvt/common/alerts.py | 65 | except Exception: | CODE |
| LOW | src/mvt/common/command.py | 93 | except Exception as exc: | CODE |
| LOW | src/mvt/common/log.py | 64 | except Exception: | CODE |
| LOW | src/mvt/common/indicators.py | 445 | except Exception: | CODE |
| LOW | src/mvt/common/logo.py | 30 | except Exception as e: | CODE |
| LOW | src/mvt/common/logo.py | 72 | except Exception as e: | CODE |
| LOW | src/mvt/common/utils.py | 100 | except Exception: | CODE |
| LOW | src/mvt/common/module.py | 137 | except Exception as exc: | CODE |
| LOW | src/mvt/common/module.py | 225 | except Exception as exc: | CODE |
| LOW | src/mvt/common/module.py | 239 | except Exception as exc: | CODE |
| LOW | src/mvt/common/module.py | 256 | except Exception as exc: | CODE |
| LOW | src/mvt/common/module_loader.py | 59 | except Exception as exc: | CODE |
| LOW | src/mvt/android/cmd_check_androidqf.py | 164 | except Exception as exc: | CODE |
| LOW | src/mvt/android/cmd_check_intrusion_logs.py | 94 | except Exception as exc: | CODE |
| LOW | src/mvt/android/artifacts/tombstone_crashes.py | 166 | except Exception as e: | CODE |
| LOW | src/mvt/android/artifacts/tombstone_crashes.py | 233 | except Exception as e: | CODE |
| LOW | src/mvt/android/modules/androidqf/mounts.py | 57 | except Exception as exc: | CODE |
| LOW | src/mvt/android/modules/androidqf/mounts.py | 73 | except Exception as exc: | CODE |
| LOW⚡ | src/mvt/android/modules/intrusion_logs/base.py | 380 | except Exception as e: | CODE |
| LOW | src/mvt/android/modules/intrusion_logs/base.py | 220 | except Exception as e: | CODE |
| LOW | src/mvt/android/modules/intrusion_logs/base.py | 280 | except Exception as e: | CODE |
| LOW | src/mvt/android/modules/intrusion_logs/base.py | 316 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | tests/artifacts/android_data/dumpsys_battery.txt | 21 | Discharge screen off time: 9d 21h 51m 40s 100ms (from 2 steps) | COMMENT |
| LOW | tests/artifacts/androidqf/dumpsys.txt | 341 | #0: +2h21m35s4ms to 75 (screen-off, power-save-off) | COMMENT |
| LOW | tests/ios_fs/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | tests/common/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | tests/android/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | tests/ios_backup/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | tests/android_androidqf/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/ios/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/ios/modules/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/common/version.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/common/module_types.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/common/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/android/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/android/artifacts/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/android/parsers/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| LOW | src/mvt/android/modules/__init__.py | 1 | # Mobile Verification Toolkit (MVT) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/mvt/ios/versions.py | 45 | # Check if it is a build | COMMENT |
| LOW | src/mvt/ios/modules/mixed/interactionc.py | 259 | # Check if the record has the current timestamp. | COMMENT |
| LOW | src/mvt/ios/modules/mixed/interactionc.py | 263 | # Check if the timestamp was already processed. | COMMENT |
| LOW | src/mvt/common/alerts.py | 61 | # Check if it has a get_slug method (MVT modules have this) | COMMENT |
| LOW | src/mvt/android/artifacts/mounts.py | 93 | # Check if it's a system partition | COMMENT |
| LOW | src/mvt/android/artifacts/mounts.py | 98 | # Check if it's mounted read-write | COMMENT |
| LOW | src/mvt/android/artifacts/mounts.py | 179 | # Check if any mount points match indicators | COMMENT |
| LOW | src/mvt/android/artifacts/settings.py | 67 | # Check if one of the dangerous settings is using an unsafe | COMMENT |
| LOW | src/mvt/android/modules/androidqf/root_binaries.py | 105 | # Check if this matches a known root binary by exact name match | COMMENT |
| LOW | …c/mvt/android/modules/intrusion_logs/security_event.py | 373 | # Check if command contains any suspicious app IDs | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/mvt/ios/decrypt.py | 23 | """This class provides functions to decrypt an encrypted iTunes backup | STRING |
| MEDIUM | src/mvt/ios/modules/net_base.py | 23 | """This class provides a base for DataUsage and NetUsage extraction | STRING |
| MEDIUM | src/mvt/ios/modules/base.py | 24 | """This class provides a base for all iOS filesystem/backup extraction | STRING |
| MEDIUM | src/mvt/ios/modules/fs/webkit_base.py | 14 | """This class is a base for other WebKit-related modules.""" | STRING |
| MEDIUM | src/mvt/common/indicators.py | 41 | """This class is used to parse indicators from a STIX2 file and provide | STRING |
| MEDIUM | src/mvt/common/indicators.py | 414 | # Create an Aho-Corasick automaton from the list of urls | COMMENT |
| MEDIUM | src/mvt/common/module.py | 42 | """This class provides a base for all extraction modules.""" | STRING |
| MEDIUM | src/mvt/android/cmd_check_bugreport.py | 63 | """This method is used to initialize the bug report analysis from an | STRING |
| MEDIUM | src/mvt/android/cmd_check_bugreport.py | 75 | """This method is used to initialize the bug report analysis from a | STRING |
| MEDIUM | src/mvt/android/modules/bugreport/base.py | 17 | """This class provides a base for all Android Bug Report modules.""" | STRING |
| MEDIUM | src/mvt/android/modules/androidqf/base.py | 17 | """This class provides a base for all Android Data analysis modules.""" | STRING |
| MEDIUM | src/mvt/android/modules/backup/base.py | 16 | """This class provides a base for all backup extractios modules""" | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/conftest.py | 34 | CODE | |
| LOW | src/mvt/ios/cmd_check_fs.py | 20 | CODE | |
| LOW | src/mvt/ios/cmd_check_backup.py | 20 | CODE | |
| LOW | src/mvt/common/command.py | 34 | CODE | |
| LOW | src/mvt/common/cmd_check_iocs.py | 18 | CODE | |
| LOW | src/mvt/android/cmd_check_bugreport.py | 23 | CODE | |
| LOW | src/mvt/android/cmd_check_androidqf.py | 41 | CODE | |
| LOW | src/mvt/android/cmd_check_intrusion_logs.py | 26 | CODE | |
| LOW | src/mvt/android/cmd_check_backup.py | 36 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .safety-policy.yml | 4 | # Otherwise, you can use the flag `safety check --policy-file <path-to-this-file>` to specify a custom location and name | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/mvt/common/updates.py | 71 | def set_latest_check(self) -> None: | CODE |
| LOW | src/mvt/common/updates.py | 91 | def set_latest_update(self) -> None: | CODE |
| LOW | src/mvt/common/indicators.py | 23 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/mvt/ios/modules/fs/analytics_ios_versions.py | 22 | """This module leverages the Analytics module in order to extract | STRING |
| LOW | src/mvt/common/indicators.py | 443 | # If it's not shortened, we just use the original URL object. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/artifacts/generate_stix.py | 18 | emails = ["foobar@example.org"] | CODE |
| LOW | tests/ios_backup/test_calendar.py | 28 | ind.ioc_collections[0]["emails"].append("user@example.org") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/mvt/ios/__init__.py | 6 | CODE | |
| LOW | src/mvt/android/__init__.py | 6 | CODE |