Every check PTKD runs, with a real exploit scenario, the impact, and how to fix it, mapped to the OWASP Mobile Top 10 and MASVS.
PTKD-CRED-SECRET Hardcoded secret in binary M1PTKD-NET-CLEARTEXT Cleartext network traffic permitted M5PTKD-NET-USERCA Network config trusts user-installed CAs M5PTKD-NET-ATS App Transport Security disabled (NSAllowsArbitraryLoads) M5PTKD-IOS-DEBUGGABLE iOS build is debuggable (get-task-allow = true) M7PTKD-IOS-ENT-GET-TASK-ALLOW Debuggable release (get-task-allow in code signature) M7PTKD-IOS-INSECURE-EXEC Process execution via system()/exec/popen M4PTKD-CFG-DEBUGGABLE Application is debuggable M8PTKD-CFG-TESTONLY Application marked test-only M8PTKD-NET-TRUSTALL TLS validation appears disabled (trust-all / accept-all hostnames) M5PTKD-SIGN-V1 APK signed with the legacy v1 (JAR) scheme M8PTKD-SUPPLY-CVE Vulnerable third-party dependency M2PTKD-DYN-CLEARTEXT Cleartext HTTP traffic at runtime M5PTKD-DYN-NOPINNING TLS interception succeeded (no certificate pinning) M5PTKD-DYN-SECRET-TRANSIT Hardcoded secret sent on the wire M1PTKD-DYN-STORAGE-SECRET Secret written to device storage M9PTKD-API-SECRET-IN-RESPONSE Secret returned in an API response M1PTKD-API-WEAK-JWT Weak JWT observed on the wire M3PTKD-NET-ATS-MEDIA App Transport Security disabled for media M5PTKD-IOS-PRIVACY-MANIFEST-MISSING Missing Apple privacy manifest (PrivacyInfo.xcprivacy) M6PTKD-IOS-REQUIRED-REASON-UNDECLARED Required-reason API used without a declared reason M6PTKD-IOS-TRACKING-UNDISCLOSED Tracking domains present but tracking not declared M6PTKD-PRIV-SENSITIVE-TO-TRACKER Sensitive data may be shared with a third-party SDK M6PTKD-IOS-TRACKER-UNDISCLOSED Third-party tracker not disclosed in the privacy manifest M6PTKD-CRYPTO-WEAK Weak cryptographic primitive M10PTKD-IOS-KEYCHAIN-ACCESSIBLE Keychain item accessible while locked M9PTKD-IOS-UNSAFE-C-STRING Unsafe C string function (buffer overflow risk) M4PTKD-PLATFORM-URLSCHEME Hijackable custom URL-scheme deep link M4PTKD-AUTH-BIOMETRIC-NOCRYPTO Biometric authentication not bound to a cryptographic key M3PTKD-CFG-SHAREDUID Deprecated android:sharedUserId in use M8PTKD-CFG-EXPORTED Exported component without a permission guard M8PTKD-WEBVIEW-FILEACCESS WebView allows file access from web content M4PTKD-STO-BACKUP Application data is backed up M9PTKD-STO-FILESHARING iTunes file sharing enabled M9PTKD-WEBVIEW-JSI WebView JavaScript bridge exposed M4PTKD-PRIV-FIREBASE Firebase Realtime Database endpoint embedded M9PTKD-BIN-NOPIE Executable is not position-independent (no PIE/ASLR) M7PTKD-COVERAGE-LIMITED Static analysis coverage limited M8PTKD-DYN-WEAKTLS Weak TLS version negotiated at runtime M5PTKD-DYN-AUTH-IN-URL Credential passed in a URL M1PTKD-DYN-PII-THIRD-PARTY Device/user PII sent to a third party M6PTKD-DYN-EXTERNAL-SENSITIVE Sensitive data written to external storage M9PTKD-DYN-LOG-SENSITIVE Sensitive data written to the log M9PTKD-API-CORS-WILDCARD Permissive CORS with credentials M3PTKD-API-VERBOSE-ERROR Server error leaks a stack trace M8PTKD-API-UNAUTH-MUTATION State-changing request succeeded without authentication M3PTKD-NET-HTTP-URL Cleartext (http://) endpoints in the binary (review) M5PTKD-NET-ATS-WEB App Transport Security disabled in web content M5PTKD-IOS-APS-DEV Development APNs (push) environment M8PTKD-IOS-WILDCARD-ID Wildcard application identifier M8PTKD-IOS-ASSOCIATED-DOMAINS-WILDCARD Wildcard associated domain (universal-link hijack surface) M4PTKD-PRIV-TRACKER Embedded third-party tracker M6PTKD-NET-ATS-EXCEPTION App Transport Security insecure exception domains M5PTKD-CFG-CUSTOMPERM Custom permission with a weak protection level M8PTKD-WEBVIEW-DEBUG WebView remote debugging enabled M8PTKD-BIN-NOENCRYPT iOS binary is not encrypted (cryptid = 0) M7PTKD-PRIV-PERMS Dangerous runtime permissions requested M6PTKD-BIN-NOCANARY Executable built without stack canaries M7PTKD-DYN-INSECURE-COOKIE Session cookie without Secure/HttpOnly M5PTKD-API-NO-HSTS First-party HTTPS API without HSTS M5PTKD-API-PII-IN-RESPONSE PII in a response over a cacheable/first-party channel M6