Well-structured security scanner with 40+ checks across 8 categories (crypto, webview, ssl, dynamic code, storage, logging, intent, zip). Each check has standardized output (id, title, severity, owasp, description, evidence). Pattern-based detection with regex compilation and de-duplication. Could be extracted as standalone library for other static analysis tools. Demonstrates non-obvious skill in security pattern detection and OWASP Mobile Top 10 mapping.

Comprehensive AndroidManifest.xml security analyzer with 10+ checks for misconfigurations (debuggable, backup, cleartext, exported components, deep links, SDK versions). Returns standardized finding dictionaries with evidence. Could be reused for other Android security tools. Clean separation of manifest parsing and security checking logic.

Pattern-based secret detection for 30+ credential types (API keys, OAuth tokens, private keys, passwords). Uses known_false_positives.txt for filtering common false positives. Returns structured findings with type, IOC, and file path. Could be extracted as standalone secret scanning library. Demonstrates skill in balancing detection sensitivity with false positive reduction.

Report generation module supporting JSON, HTML, PDF, and TXT formats. Uses simple template substitution with HTML escaping for XSS prevention. PDF generation via xhtml2pdf. Could be reused for other reporting needs. Clean separation of data preparation and rendering logic.