morf

MORF is a Mobile Reconnaissance Framework designed for offensive security, specifically engineered to discover hardcoded secrets within compiled mobile application artifacts (Android `.apk` and iOS `.ipa`). Unlike traditional source code scanners, MORF operates on the final shipped binaries, utilizing a robust detection engine to verify the presence and activity of secrets, while also generating Software Bills of Materials (SBOM) and Common Vulnerability and Exposure (CVE) reports. Key features include a scalable service architecture, continuous integration (CI) compatibility, and compatibility with leading security standards such as SARIF and OWASP MASVS.