About Abyss

Abyss is a security analysis service for built iOS and Android application binaries. It analyzes the artifacts you actually distribute and identifies risks in configuration, libraries, secrets, and implementation.

Platform	Input	Note
iOS	An extracted .app directory	You cannot select an .ipa directly
Android	An .apk file	Provide an APK rather than an AAB

Adding both iOS and Android binaries to the same scan enables cross-platform analysis. You can also scan either platform on its own.

How a scan works

1. Create an application to group scan history.
2. Upload an .app or .apk.
3. Review the credit cost and start the scan.
4. Review the report and vulnerabilities.
5. Check the security gate decision and manage owners, due dates, and exceptions.

Abyss analyzes binaries without running them. A scan can take up to about an hour and continues on the server if you close the page. For results that best reflect production, use an artifact signed and obfuscated with the same settings as the release build.

Caution

Binaries and scan results may contain confidential information. Verify the organization and target application before uploading.

Three core concepts

Concept	Purpose	Example
Application	Groups the history for one product	“Abyss Mobile”
Scan	One analysis of a specific version	1.4.0 (42)
Vulnerability	A remediation item tracked across scans	“Cleartext HTTP traffic is permitted”

When the same vulnerability is detected in a later scan, Abyss adds detection history instead of creating a separate item. This lets you continue managing its owner and exception decisions.