Vizillo AI safeguards exceptionally sensitive device capabilities. We believe security and trust are earned through radical transparency and disciplined engineering verification.
The Vizillo AI Android app (com.verifyscams.app) has been rigorously self-assessed against OWASP MASVS L1 (MAS-L1 profile) and MAS-P baseline privacy using the OWASP Mobile Application Security Testing Guide (MASTG v2.0.0). In alignment with OWASP guidelines, this represents an exhaustive internal engineering self-audit and remediation pass, not an independent third-party certification.
Automated backups disabled (allowBackup="false") with explicit XML exclusions. Window FLAG_SECUREapplied to block screenshots & recent-app switcher previews during PIN entry. Release logging stripped via ProGuard. Zero sensitive files in external shared storage.
Modern SHA-256 threat verification. AppLock master PIN protected with a 16-byte SecureRandom salt per device with automatic legacy migration. Zero hardcoded credentials in source or committed files.
Industry-standard Supabase OAuth/JWT over TLS 1.3 with server-side token revocation on logout. PostgreSQL Row-Level Security (RLS) guarantees user isolation. Official AndroidX BiometricPrompt with strong biometric enforcement and mandatory PIN re-prompting.
Cleartext HTTP completely disabled at the operating system level (cleartextTrafficPermitted="false" in network_security_config.xml). TLS verified against the Android system trust store with no trust-all bypasses. Certificate pinning actively enforced on malware intelligence feed (mb-api.abuse.ch).
Background services unexported (exported="false"). All PendingIntent flags set to FLAG_IMMUTABLE. WebViews hardened with file access disabled (allowFileAccess = false) and restricted to trusted HTTPS domains. Notifications set to VISIBILITY_PRIVATE to protect lock-screen privacy.
Targeting Android 15+ / 16 preview (targetSdk = 36, minSdk = 29). Release builds minified and shrunk with R8. Google Play In-App Updates and forced kill-switch update flows active. Inbound scan payloads sanitized against injection.
Zero Google Advertising ID (AD_ID node stripped). Dangerous permissions preceded by explicit in-app rationale prompts. SMS and Call Log permissions completely eliminated. Direct self-service data deletion flow available in-app and online.
Following our MASVS L1 baseline audit, the engineering team executed and verified 10 direct security remediations in the Android codebase:
While MAS-L1 establishes the essential security baseline, Vizillo AI is advancing toward the MAS-L2 (Advanced Security) profile to protect against sophisticated client-side threats and rooted device environments:
vizillo.com and *.supabase.co (currently enforced on mb-api.abuse.ch).We welcome reports from independent security researchers. If you identify a potential security issue in Vizillo AI, please notify our team promptly.