Security inspection
Understand what your apps can do.
Heirst Secure helps you inspect app permissions and combinations, compare changes between scans, review device-security indicators, and examine APK structure before deciding what to do.
Status: Public beta · Version 1.0.0
Heirst SecurePermission combination
SMS + Internet
Could intercept one-time codes
Since your last scan: 1 new app
A signal to investigate — not a malware verdict
Look beyond a permission list
A combination such as SMS + internet can describe a capability worth reviewing. Permissions and patterns describe capability, not intent or proof of malicious behaviour. Legitimate apps may trigger findings.
Combination patterns it looks for
- SMS + Internet — could intercept one-time codes
- Screen overlay + Internet — could draw fake screens over other apps
- App install + Internet — could download and install other apps
- Microphone + Location + Contacts — could be used for covert monitoring
- Contacts + Call log + Internet — could collect contact data
Granted permissions, in combination
Lists installed apps and reviews the permissions they were actually granted — not just requested — using combination rules rather than single permissions.
Patterns, described as capabilities
Each pattern is described as what an app could do, never as an accusation against a named app.
Compare changes between scans
Changes can be signals to investigate. Not every change is malicious: ordinary updates are expected, and the first scan has nothing to compare with.
Changes between scans
Compares each scan with the previous one: a changed signing certificate, a changed APK file at the same version, and newly installed apps. The first scan has nothing to compare and reports no changes.
Check device-security indicators
Device-security indicators
Summarises selected device-security indicators — root traces, USB debugging, screen lock, security-patch age, unsupported Android version — as a 0–100 score.
The device score summarises selected indicators. It is not a guarantee that a device is secure.
Inspect an APK
Files you pick
Checks folders you pick for installers, Windows programs, macro-enabled documents and double extensions such as invoice.pdf.apk, while avoiding false alarms on names like app.v2.1.apk.
APK structure
Opens an APK file and reads its binary manifest and code string table with the app’s own parser — no third-party APK library — to show components and capabilities that a permission list does not reveal.
A string or component found in an APK is evidence that it is present in the file, not proof that the corresponding behaviour will execute. Static analysis can produce false positives and cannot establish that an app is safe.
How an inspection works
Scan installed apps
See which permissions each app was actually granted.
Review combinations and changes
Read what each pattern could allow, and what changed since your last scan.
Check device indicators
Screen lock, USB debugging, patch age and similar settings, summarised.
Inspect files before installing
Open an APK or check a folder you pick.
Decide
Use the explanation to decide; the app guides you to Android’s settings for any change.
What a finding means
- Observation
- The app requests a combination of capabilities.
- Possible implication
- The combination may be relevant to a known risk pattern.
- What to do
- Review the app’s purpose, developer, source, and behaviour before taking action.
Your data, your lists
Lists you load yourself
Uses only the threat signatures (SHA-256) and DNS blocklists you load yourself; nothing is downloaded automatically. Blocklists can be plain domain lists or hosts files.
Privacy and local-first design
The only network traffic Heirst Secure creates is DNS forwarding by the optional DNS shield, sent to the DNS server your device already uses. There is no Heirst server, analytics, crash reporting, ad or tracker SDK, Google Play Services or Firebase, remote signature feed, automatic blocklist download or HTTP call. Threat signatures and blocklists are files you load yourself.
| Permission | Why the app asks for it | Android name |
|---|---|---|
| All installed apps | Needed to list and audit every installed app. | QUERY_ALL_PACKAGES |
| Internet, network and Wi-Fi state | Used only by the DNS shield to forward DNS lookups to your device’s DNS server. | INTERNET · ACCESS_NETWORK_STATE · ACCESS_WIFI_STATE |
| Storage (Android 12L and older) | File scanning on older Android versions; newer versions use the folder picker. | READ_EXTERNAL_STORAGE |
| Notifications and foreground service | Shows new-app warnings, and a notification while the DNS shield is on. | POST_NOTIFICATIONS · FOREGROUND_SERVICE · FOREGROUND_SERVICE_SPECIAL_USE |
| Uninstall request | Opens Android’s own uninstall dialog; you confirm every uninstall. | REQUEST_DELETE_PACKAGES |
| Run at startup | Keeps the periodic new-app check scheduled after the phone restarts. | RECEIVE_BOOT_COMPLETED |
| VPN (system consent dialog) | Required by Android to run the local DNS shield. Only one VPN can be active at a time. | — |
Important limitations
Not an antivirus
Heirst Secure is not an antivirus. Android does not let any app scan the whole phone in real time, stop other apps, or revoke their permissions; Heirst Secure guides you to the right settings page instead.
Capabilities, not intent
Findings describe capabilities, not intent. Legitimate apps can trigger them; a finding is not proof of malware.
Signatures only from you
The signature list only contains what you load. Without your data, the app cannot recognise known malware by signature.
Root detection can be hidden
Root detection is file-based and can be hidden by concealment tools.
Static analysis has limits
A string found inside an APK proves it is present in the file, not that the code runs. Static analysis can produce false positives and cannot prove an app is safe.
A score is not a guarantee
The device score summarises selected indicators. It is not a guarantee that a device is secure.
DNS-over-HTTPS bypasses the shield
Browsers using DNS-over-HTTPS bypass the DNS shield.
One VPN at a time
Android allows only one active VPN; turning the shield on disconnects another VPN.
A short built-in blocklist
The built-in blocklist is short and covers ad trackers, not phishing. Load your own list for real coverage.
Strict Private DNS stays on
The shield will not start with strict Private DNS, because forwarding would downgrade encrypted DNS to plain text.
Verification status
These parts exist in the current build but have not been proven on real devices yet. Do not rely on them as tested features.
This beta on real devices
Features up to an earlier version were verified on an Android 13 phone. Those added since, including the fix buttons, ignoring findings and the welcome screens, have not yet been run on a device.
New-app check
Designed to check each newly installed app and notify you when it has warnings — right away while Heirst Secure is running, otherwise within a few hours. It is not real-time scanning. It depends on Android delivering install events and running scheduled jobs, and it has not yet been run on a real device.
About the DNS shield
An optional local VPN that filters DNS lookups only. Blocked domains get “not found”; everything else is forwarded only to the DNS server your device already uses. It refuses to start if the device reports no DNS server or uses strict Private DNS, and says why — before asking for VPN permission.
DNS filtering engine
The DNS filtering engine has not yet been verified on real-device traffic. Do not rely on the DNS shield as proven protection.
APK inspection on phones
APK inspection has been tested on real APK files on a computer, not yet on a phone across many APKs.
Share / Open with and report files
Sending an APK to Heirst Secure through Share / Open with, and saving a report file, have not yet been run on a device.
Requires Android 8.0 or later (current build).
Also in the app
From finding to action
Every finding that can be fixed has a button naming the Android settings screen it opens. Findings you have reviewed can be ignored after a confirmation and restored later from Settings.
English and Indonesian
In English and Indonesian; on Android 13+ the language can be chosen for the app alone.
Download the beta
Heirst Secure 1.0.0 is a public beta, offered here as a signed APK file. It is not in an app store yet: you install it yourself, and Android asks for your permission first.
About this file
- Version
- 1.0.0
- Released
- 15 October 2026
- Size
- 1.5 MB
- Requires
- Android 8.0 or later
- File name
- heirst-secure-1.0.0.apk
Free to use. The source code is not published. Installing or using the app means you accept the Heirst End-User License Agreement. Read the license agreement
How to install
- Open this page on your Android phone and download the APK.
- Open the downloaded file. Android asks you to allow installs from the app you used, such as your browser or file manager. Allow it for that app only, then go back.
- Tap Install. Play Protect may offer to scan the app or show a warning, because it does not know this developer yet. Read the message before you continue.
- After installing, you can switch the permission to install unknown apps off again.
Check the file
Before installing, you can compare the file’s SHA-256 checksum with the value below, for example with sha256sum on a computer. Every version is signed with the same certificate, whose fingerprint is shown as well.
- SHA-256 of the file
- 31c2dfef5ea686d903e4ec39144a47b1725522a31df3835aaeeb556faf5c6db1
- SHA-256 of the signing certificate
- 9069a7ded8b09ecf0b4c07c735b020e6d3039d80dfbb0e5e641a4a7da7480f8f
Updates
The app does not update itself or check for updates. New versions are published on this page and signed with the same certificate, so installing one over the old version keeps your data.
This is a beta. Some parts have not yet been verified on a real device, so read the verification status and the limitations on this page before you rely on it. Verification status · Important limitations
Questions about Heirst Secure
The current builds of both apps require Android 8.0 or later.
No. Android does not let any app scan the whole phone in real time or stop other apps. Heirst Secure is an inspection tool: it explains app capabilities, changes between scans and device-security indicators.
No. Findings describe what an app is able to do, not what it intends. Legitimate apps can trigger them. Review the app’s purpose, developer and source before you act.
No. It has no live malware database: it recognises only the signatures you load yourself, and its heuristics can miss things.
No. The score summarises selected indicators such as screen lock, USB debugging and security-patch age. It is not a guarantee.
Which components and capabilities an APK file declares, and which names appear in its code, before you install it. A name in the file is not proof that the code runs, and static inspection cannot prove that an app is safe.
No. Its built-in list is short and covers ad trackers, not phishing, and its filtering engine has not yet been verified on real-device traffic. Do not rely on it as protection.
No. Heirst Clean does not request Android’s internet permission, so it cannot send data anywhere. Heirst Secure has no server and makes no HTTP calls; its only network traffic is the optional DNS shield forwarding lookups to your device’s own DNS server.
Auditing installed apps is its main job, so it requests Android’s permission to list every installed app.
No. Android allows only one active VPN, so turning the shield on disconnects the other one.
It refuses when strict Private DNS is on, because forwarding would downgrade your encrypted DNS to plain text, and when your device reports no DNS server. It tells you which one applies.
The apps are not in an app store yet, so you install the APK file yourself. Android asks you to allow installs from the browser or file manager you used, and Play Protect may offer to scan the app because it does not know the developer yet. Install only files from this website, and check that the SHA-256 checksum matches the one on the product page.
Compare before you choose
See how Heirst Secure and Heirst Clean differ, or read how each app handles your data.