Question 1

What does per application per month mean?

Accepted Answer

An application is identified by its package name (Android) or bundle identifier (iOS). All builds sharing the same identifier within the same platform are counted as a single application. Each license is a monthly slot that you can rotate over your applications each month. If for instance you have 6 applications (3 Android and 3 iOS) and you opt in for 2 licenses. You can scan 2 applications the first month as many times as needed and then switch to 2 different applications next month, etc.

Question 2

How do I get started?

Accepted Answer

Create an account by clicking on the register button and follow the guide steps to create your first scan.

Question 3

How many licenses do I need if my app is available on both Android and Apple Stores?

Accepted Answer

Applications on Android and Apple count separately, so you will need 2 licenses in that case. However, if the application for one platform has different application IDs for the dev, QA, and prod versions, you need only a license to scan them.

Question 4

How do you uniquely identify a mobile application?

Accepted Answer

Ostorlab determines the same application based on the bundle id for iOS and the package name for Android. These attributes are shown on the scan list and scan report. In some cases, developers use different bundle ids/package names for production, dev and test. Ostorlab supports aliasing these values by opening a support request and are counted/considered as a single application.

Question 5

What formats are supported by Ostorlab to perform a scan ?

Accepted Answer

Supported formats are APK, XAPK and AAB for Android and non-encrypted IPA for iOS. Ostorlab also supports scanning directly from the store or using a TestFlight link.

Question 6

After how long does Ostorlab archive the report?

Accepted Answer

You can archive a scan at will by selecting the menu archive on the scan dashboard.

Question 7

Does Ostorlab need any network connection or ports enabled for the back end analysis?

Accepted Answer

If the application is internet facing, we don't need any special access. If the application is not internet facing, we require whitelisting the IP addresses used by the scanner.

Question 8

Can I run a dynamic scan with a community plan?

Accepted Answer

Dynamic scans are only included in our paid plans. The community plan only offers static scans.

Question 9

Why is my scan stuck on 'Queued' status?

Accepted Answer

Community scans share a common pool of workers to analyze the application. The waiting time from "queued" to "running" will vary depending on the load.

Question 10

Is it possible to customize the risk rating of findings?

Accepted Answer

Yes! You can change the risk rating of findings, and mark their corresponding tickets as false-positive or exception.

Question 11

Can I analyze different versions of my application?

Accepted Answer

Your license is valid for one application in all stage of its lifecycle, for all versions, including versions on the store, in development or in testing.

Question 12

Do I have limitations in the number of persons in my team accessing the tool?

Accepted Answer

Your plan is linked to your Organization in Ostorlab. You can invite as many members as you need in your organization and share scans results, updates, remediations ...

Question 13

I'm getting an error saying 'Too many failed login attempts'.

Accepted Answer

To prevent brute force attacks, the account locks after multiple login attempts. It is automatically unlocked after some time.

Choose the coverage that fits your needs

Agentic Pentest

AppSec

Enterprise

What security teams say about Ostorlab

Secure the mobile app and everything behind it

Continuous discovery

Runtime intelligence

From finding to fix

Teams shipping mobile products

One connected security workspace

Security belongs in the tools your teams already use

How AI Security Credits work

Compare plans

Frequently asked questions

Ready to secure your applications?