SNPIT — Mobile App

Audit report published Aug 2026. iOS and Android (Flutter) · Dart.

Findings at a glance

Severity	Count
High	1
Low	1
Informational	4
Total	6

Summary

Safe Edges reviewed the SNPIT Flutter mobile app codebase (snpit-app-develop). Six issues were identified: one High, one Low, three Informational and one Note. The High issue was that fake-location detection runs only on Android while the backend accepts client-supplied GPS coordinates for location-based rewards and battle multipliers, so spoofed locations can claim rewards. The original report did not record resolution statuses.

Read the full report (PDF).

Findings

High (1)

• H-01 Location Spoofing Enables Reward Abuse By Intentionally Allowing iOS

Low (1)

• L-01 Sentry Crash Reporting Includes User PII Without Proper Scrubbing

Informational (4)

• I-01 Global iOS App Transport Security Bypass Enabled
• I-02 Marketplace One-Time JWT Passed Through URL Query Parameter
• I-03 Plaintext Local Storage of Access Tokens and Location Metadata
• N-01 Privy Wallet Linking Could Potentially Accept Unverified WebView JavaScript Messages

More published reports

Related services

Get a fixed quote in 24 hours

Send the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.