{
  "note": "Static-analysis detection corpus for the Mobile loadout. Fixtures are decompiled artifacts (AndroidManifest snippets + source strings) with KNOWN issues + hardened controls. Scored by the built-in ruleset in scripts/mobile-static-bench.mjs. DIRECTIONAL + STATIC only (manifest misconfig + hardcoded secrets/cleartext) — NOT dynamic runtime exploitation (the opt-in frida/objection path). Secrets are format-valid but fake. REGRESSION corpus — the ruleset was written against these fixtures, so a pass is a detector-regression floor, NOT a real-world detection rate.",
  "fixtures": [
    {
      "id": "manifest-debuggable",
      "kind": "manifest",
      "desc": "Debuggable + allowBackup enabled in production",
      "clean": false,
      "expect": ["M-DEBUGGABLE", "M-BACKUP"],
      "content": "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.demo.app\">\n  <application android:debuggable=\"true\" android:allowBackup=\"true\" android:label=\"Demo\">\n    <activity android:name=\".MainActivity\" />\n  </application>\n</manifest>\n"
    },
    {
      "id": "manifest-exported-provider",
      "kind": "manifest",
      "desc": "Content provider exported with no guarding permission",
      "clean": false,
      "expect": ["M-EXPORTED"],
      "content": "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.demo.app\">\n  <application android:label=\"Demo\">\n    <provider android:name=\".DataProvider\" android:authorities=\"com.demo.app.data\" android:exported=\"true\" />\n  </application>\n</manifest>\n"
    },
    {
      "id": "manifest-cleartext",
      "kind": "manifest",
      "desc": "Cleartext HTTP traffic permitted app-wide",
      "clean": false,
      "expect": ["M-CLEARTEXT"],
      "content": "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.demo.app\">\n  <application android:usesCleartextTraffic=\"true\" android:label=\"Demo\" />\n</manifest>\n"
    },
    {
      "id": "code-aws-key",
      "kind": "code",
      "desc": "Hardcoded AWS access key id in source",
      "clean": false,
      "expect": ["S-AWS-KEY"],
      "content": "public class Config {\n    static final String AWS_KEY = \"AKIAIOSFODNN7EXAMPLE\";\n    static final String ENDPOINT = \"https://api.demo.com\";\n}\n"
    },
    {
      "id": "code-google-key",
      "kind": "code",
      "desc": "Hardcoded Google API key in source",
      "clean": false,
      "expect": ["S-GOOGLE-API"],
      "content": "public class Maps {\n    private static final String API = \"AIzaSyD-EXAMPLEfakeKEY1234567890abcdEFG\";\n}\n"
    },
    {
      "id": "code-private-key-http",
      "kind": "code",
      "desc": "Embedded private key + cleartext HTTP endpoint",
      "clean": false,
      "expect": ["S-PRIVATE-KEY", "E-HTTP-URL"],
      "content": "String pem = \"-----BEGIN PRIVATE KEY-----\\nMIIBVAIBADANBgkq\\n-----END PRIVATE KEY-----\";\nString url = \"http://legacy.demo.com/api\";\n"
    },
    {
      "id": "manifest-hardened-control",
      "kind": "manifest",
      "desc": "Hardened manifest (control) — flags off, exported component guarded by permission",
      "clean": true,
      "expect": [],
      "content": "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.demo.app\">\n  <application android:debuggable=\"false\" android:allowBackup=\"false\" android:usesCleartextTraffic=\"false\" android:label=\"Demo\">\n    <provider android:name=\".DataProvider\" android:exported=\"true\" android:permission=\"com.demo.app.PERMISSION\" />\n  </application>\n</manifest>\n"
    },
    {
      "id": "code-clean-control",
      "kind": "code",
      "desc": "Clean source (control) — secret from env, HTTPS only",
      "clean": true,
      "expect": [],
      "content": "public class Net {\n    static final String BASE = \"https://secure.demo.com\";\n    String token = System.getenv(\"API_TOKEN\");\n}\n"
    }
  ]
}