The companion app is not a peripheral — it is the sole privileged-command path to the LNK9. Enroll, PIN reset, unlock, lock and owner add/remove all leave the phone as an authenticated BLE command. In a Cyber-Physical System whose successful authentication mechanically releases the trigger sear, compromise of the app is compromise of the gun. That is why §6 is audited with the same rigor as the radio link itself.
| Severity | MASVS | Test | Finding |
|---|---|---|---|
| High | MASVS-CODE | MOB-001 | Non-production backend endpoint shipped in release build A development/staging API base URL is embedded in the shipped, production-signed app. Dev backends are commonly weaker (verbose errors, looser auth, test data) and widen the attack surface against the firearm's command/cloud path. |
| Medium | MASVS-RESILIENCE | MOB-001 | App signed with a development identity The signing certificate names a Development/Debug identity rather than a guarded production release key — review the release signing process and key custody. |
| Medium | MASVS-PLATFORM | MOB-004 | 1 app-owned exported component(s) Exported components are reachable by other apps on the device. Confirm each validates its caller and cannot be coerced into a privileged action. |
| Low | MASVS-NETWORK | MOB-001 | No Network Security Config No explicit network_security_config.xml. Cleartext is off by default for targetSdk≥28, but an explicit config (+ cert pinning) is recommended for a safety-critical app. |
| Low | MASVS-CODE | MOB-001 | Firebase API key embedded A Firebase/Google API key is shipped in the app. This is normal for Firebase but MUST be locked down with API key restrictions + Firebase Security Rules, or it enables abuse of the project's backend. |
| Low | MASVS-CODE | MOB-001 | Sentry DSN embedded A Sentry DSN is embedded (expected for crash reporting); confirm it is ingestion-only and rate-limited so it cannot be abused. |
| Info | MASVS-CODE | BLE-003 | Proprietary BLE GATT contract recovered (15 UUIDs) The app's custom BLE service/characteristic UUIDs were recovered from the binary. These are the LNK9 command channel — classify which characteristic commands the sear and gate it under the safety interlock when probing (BLE-003). |
From the shipped app alone — no firmware, no chip extraction — we recovered the LNK9's proprietary GATT contract: 15 custom service/characteristic UUIDs. Somewhere in this set is the handle whose write the firmware reads as the unlock/owner command. This is the map of the gun's command channel, and it is the starting point for the live BLE testing (BLE-003).
Every figure below is a live screen of the audit console running against the real build — the same tool, keyboard-driven, that produced the findings above. Tabs: Overview Findings Surface Network BLE.