{"id":19237414,"url":"https://github.com/datatheorem/data-theorem-mobile-secure-buildkite-plugin","last_synced_at":"2026-06-14T18:34:49.858Z","repository":{"id":247933998,"uuid":"827273619","full_name":"datatheorem/data-theorem-mobile-secure-buildkite-plugin","owner":"datatheorem","description":"Data Theorem Mobile Secure Buildkite Plugin","archived":false,"fork":false,"pushed_at":"2025-12-15T19:40:12.000Z","size":348,"stargazers_count":0,"open_issues_count":0,"forks_count":2,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-12-19T03:21:50.365Z","etag":null,"topics":["buildkite-plugin"],"latest_commit_sha":null,"homepage":"https://www.datatheorem.com/","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/datatheorem.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-07-11T10:28:35.000Z","updated_at":"2025-12-15T19:37:09.000Z","dependencies_parsed_at":"2025-07-16T02:25:44.335Z","dependency_job_id":"f1149d5f-7a86-4344-9f66-fdfc6acf0166","html_url":"https://github.com/datatheorem/data-theorem-mobile-secure-buildkite-plugin","commit_stats":null,"previous_names":["datatheorem/data-theorem-mobile-secure-buildkite-plugin"],"tags_count":11,"template":false,"template_full_name":null,"purl":"pkg:github/datatheorem/data-theorem-mobile-secure-buildkite-plugin","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datatheorem%2Fdata-theorem-mobile-secure-buildkite-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datatheorem%2Fdata-theorem-mobile-secure-buildkite-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datatheorem%2Fdata-theorem-mobile-secure-buildkite-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datatheorem%2Fdata-theorem-mobile-secure-buildkite-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/datatheorem","download_url":"https://codeload.github.com/datatheorem/data-theorem-mobile-secure-buildkite-plugin/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datatheorem%2Fdata-theorem-mobile-secure-buildkite-plugin/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34333806,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-14T02:00:07.365Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["buildkite-plugin"],"created_at":"2024-11-09T16:26:36.952Z","updated_at":"2026-06-14T18:34:49.851Z","avatar_url":"https://github.com/datatheorem.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Data Theorem Mobile Secure BuildKite Plugin\n\nData Theorem's Mobile Secure will scan each pre-production release automatically (up to 7000 releases/day)\nfor security \u0026 privacy issues using static, dynamic, and behavioral analysis for both iOS and Android applications.\n\nMore information can be found here:  \nhttps://www.datatheorem.com/products/mobile-secure\n\n## Examples\n\n### Basic Example\nAdd the following to your `pipeline.yml`:\n\n```yml\nsteps:\n  - label: \"Build Mobile App Binary\"\n    # replace this step with your own logic to build the pre-prod mobile binary that you want to scan\n    command: \"echo 'Example mobile binary build step...'\"\n\n  - label: \"Upload Mobile App Binary to Data Theorem for scanning\"\n    plugins:\n      - datatheorem/data-theorem-mobile-secure:\n          UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)\n          BINARY_PATH: \"app-debug.apk\" # path to the pre-prod mobile binary built in the previous step\n```\n\n### Example with optional `SOURCEMAP_PATH`:\nAn optional Java mapping.txt file for deobfuscating Android binaries.\n\n```yml\nsteps:\n  - label: \"Build Mobile App Binary\"\n    # replace this step with your own logic to build the pre-prod mobile binary that you want to scan\n    command: \"echo 'Example mobile binary build step...'\"\n\n  - label: \"Upload Mobile App Binary to Data Theorem for scanning\"\n    plugins:\n      - datatheorem/data-theorem-mobile-secure:\n          UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)\n          BINARY_PATH: \"app-debug.apk\" # path to the pre-prod mobile binary built in the previous step\n          SOURCEMAP_PATH: \"mapping.txt\" # path to mapping.txt\n```\n\n### Example with scan result polling\nOptionally, you can configure the plugin to wait for the scan to complete and print out the number of new security findings.\nTo do this, add the extra flag `POLL_SCAN_RESULTS: true`\nThis mode will also require to set up a Data Theorem Mobile Results API Key\nIt can be retrieved or created at [DevSecOps -\u003e Data Theorem Results API](https://www.securetheorem.com/devsecops/v2/results_api_access)\nAnd set it as a secret accessible to your BuildKite pipeline.\n\n```yml\nsteps:\n  - label: \"Build Mobile App Binary\"\n    # replace this step with your own logic to build the pre-prod mobile binary that you want to scan\n    command: \"echo 'Example mobile binary build step...'\"\n\n  - label: \"Upload Mobile App Binary to Data Theorem for scanning\"\n    plugins:\n      - datatheorem/data-theorem-mobile-secure:\n          UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)\n          BINARY_PATH: \"app-debug.apk\" # path to the pre-prod mobile binary built in the previous step\n          POLL_SCAN_RESULTS: true\n          MOBILE_RESULTS_API_KEY: $(buildkite-agent secret get DT_MOBILE_RESULTS_API_KEY)\n```\n\nThe plugin's logs should look like this for a successful scan with no discovered security issues\n![buildkite-data-theorem-mobile-secure-plugin-polling-mode-no-issues.png](images%2Fbuildkite-data-theorem-mobile-secure-plugin-polling-mode-no-issues.png)\n\n### Example with vulnerability blocking\nThe plugin supports automatic build blocking based on security findings. When `BLOCK_ON_SEVERITY` is specified, the plugin will automatically enable polling and block the build if any vulnerabilities are found at or above the specified severity level.\n\n```yml\nsteps:\n  - label: \"Build Mobile App Binary\"\n    # replace this step with your own logic to build the pre-prod mobile binary that you want to scan\n    command: \"echo 'Example mobile binary build step...'\"\n\n  - label: \"Upload Mobile App Binary to Data Theorem for scanning\"\n    plugins:\n      - datatheorem/data-theorem-mobile-secure:\n          UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)\n          BINARY_PATH: \"app-debug.apk\" # path to the pre-prod mobile binary built in the previous step\n          BLOCK_ON_SEVERITY: \"HIGH\" # Block build on HIGH severity vulnerabilities\n          MOBILE_RESULTS_API_KEY: $(buildkite-agent secret get DT_MOBILE_RESULTS_API_KEY)\n```\n\n### Example with glob patterns for multiple files\nYou can use glob patterns to match multiple files and upload them all at once (up to 3 files):\n\n```yml\nsteps:\n  - label: \"Build Mobile App Binaries\"\n    command: \"echo 'Example mobile binary build step...'\"\n\n  - label: \"Upload Mobile App Binaries to Data Theorem for scanning\"\n    plugins:\n      - datatheorem/data-theorem-mobile-secure:\n          UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)\n          BINARY_PATH: \"build/outputs/apk/**/*.apk\" # Upload all APKs in the build directory\n          MOBILE_RESULTS_API_KEY: $(buildkite-agent secret get DT_MOBILE_RESULTS_API_KEY)\n          POLL_SCAN_RESULTS: true\n```\n\n### Example with DAST credentials and metadata\nYou can provide DAST authentication credentials and additional metadata for your uploads:\n\n```yml\nsteps:\n  - label: \"Upload Mobile App Binary with DAST credentials\"\n    plugins:\n      - datatheorem/data-theorem-mobile-secure:\n          UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)\n          BINARY_PATH: \"app-debug.apk\"\n          USERNAME: \"test-user@example.com\"\n          PASSWORD: $(buildkite-agent secret get DAST_PASSWORD)\n          COMMENTS: \"Build from commit ${BUILDKITE_COMMIT}\"\n          RELEASE_ID: \"${BUILDKITE_BUILD_ID}\"\n          EXTERNAL_ID: \"my-app-identifier\"\n```\n\n### Example with warning-only severity check\nUse `WARN_ON_SEVERITY` to get warnings about vulnerabilities without failing the build:\n\n```yml\nsteps:\n  - label: \"Upload with severity warnings\"\n    plugins:\n      - datatheorem/data-theorem-mobile-secure:\n          UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)\n          BINARY_PATH: \"app-debug.apk\"\n          WARN_ON_SEVERITY: \"MEDIUM\" # Warn about medium and high severity issues\n          MOBILE_RESULTS_API_KEY: $(buildkite-agent secret get DT_MOBILE_RESULTS_API_KEY)\n```\n\n### Example with ALL_ISSUES scope\nCheck all open issues in the mobile app, not just the current scan:\n\n```yml\nsteps:\n  - label: \"Check all open issues\"\n    plugins:\n      - datatheorem/data-theorem-mobile-secure:\n          UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)\n          BINARY_PATH: \"app-debug.apk\"\n          BLOCK_ON_SEVERITY: \"HIGH\"\n          SEVERITY_CHECK_SCOPE: \"ALL_ISSUES\" # Check all open issues, not just this scan\n          MOBILE_RESULTS_API_KEY: $(buildkite-agent secret get DT_MOBILE_RESULTS_API_KEY)\n```\n\n### Example with static scan only\nWait for only the static scan to complete, not the full scan:\n\n```yml\nsteps:\n  - label: \"Wait for static scan only\"\n    plugins:\n      - datatheorem/data-theorem-mobile-secure:\n          UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)\n          BINARY_PATH: \"app-debug.apk\"\n          POLL_SCAN_RESULTS: true\n          WAIT_FOR_STATIC_SCAN_ONLY: true\n          MOBILE_RESULTS_API_KEY: $(buildkite-agent secret get DT_MOBILE_RESULTS_API_KEY)\n```\n\n## Vulnerability Blocking\nThe plugin supports automatic build blocking based on security findings. When `BLOCK_ON_SEVERITY` is specified, the plugin will:\n\n1. Wait for the scan to complete (default: 5 minutes, configurable via `POLLING_TIMEOUT`)\n2. Check for security findings at or above the specified severity level\n3. Block the build if any vulnerabilities are found at the minimum severity threshold\n\n**Important:** Vulnerability blocking requires a separate `MOBILE_RESULTS_API_KEY` with results access permissions.\n\n### Severity Levels\n- `HIGH`: Block on high severity vulnerabilities only\n- `MEDIUM`: Block on medium and high severity vulnerabilities\n- `LOW`: Block on all severity vulnerabilities (low, medium, high)\n\n## Configuration\n\n### `UPLOAD_API_KEY` (Required, string)\nAPI Key you can retrieve in the Data theorem Portal [DevSecOps -\u003e Scan via CI/CD](https://www.securetheorem.com/devsecops/v2/scancicd)\n\nHard-coding the raw value of the API key is not recommended for security reasons.\nWe recommend using [BuildKite Secrets](https://buildkite.com/docs/pipelines/security/secrets/buildkite-secrets)\n\n- On your agent cluster, define a secret named `DT_UPLOAD_API_KEY` and set the value to what you have retrieved from the Data Theorem Portal\n- In the BuildKite pipeline definition, you can pass the API Key as `UPLOAD_API_KEY: $(buildkite-agent secret get DT_UPLOAD_API_KEY)` in the plugin's inputs\n\n### `BINARY_PATH` (Required, string)\nPath to the mobile binary (APK, IPA, APPX or XAP) to be scanned.\n\nYou can use a glob pattern to indicate variable parts of the build's file name (for example, if the app's version number or build date is in the file name).\n\nExamples of glob patterns:\n- `app-*.apk` : search for any apk starting with `app-` in workspace root directory\n- `**/app-*.ipa` : search for any ipa starting with `app-` in any subdirectory of the workspace\n- `{,**/}app-debug*.*` : search for any file containing `app-debug` in root the directory or in any subdirectory of the workspace\n\nIf multiple files match the provided pattern all matching files will be uploaded. The pattern should not match more than 3 files.\n\n### `SOURCEMAP_PATH` (Optional, string)\nAn optional path to a Java mapping.txt file for deobfuscating Android binaries.\nNote: Once deobfuscation is enabled for PRE_PROD or ENTERPRISE Android app, future uploads of the same app will also require a mapping file.\nSee [How To Enable De-obfuscation of Android Scan Results Using A Mapping File](https://datatheorem.atlassian.net/servicedesk/customer/portal/1/article/61669389) for more information.\n\n### `POLL_SCAN_RESULTS` (Optional, boolean)\nWhen set to `true`, the plugin will poll for the scan's status until completion and print if the scan has found any new issues\nThis requires a Data Theorem Mobile Results API Key to be set (see below)\n\n### `MOBILE_RESULTS_API_KEY` (Optional, string)\nAPI Key you can retrieve in the Data theorem Portal [DevSecOps -\u003e Data Theorem Results API](https://www.securetheorem.com/devsecops/v2/results_api_access)\nThis is only required if you want to poll for scan results instead of exiting after starting the scan.\n\nHard-coding the raw value of the API key is not recommended for security reasons.\nWe recommend using [BuildKite Secrets](https://buildkite.com/docs/pipelines/security/secrets/buildkite-secrets)\n\n- On your agent cluster, define a secret named `DT_MOBILE_RESULTS_API_KEY` and set the value to what you have retrieved from the Data Theorem Portal\n- In the BuildKite pipeline definition, you can pass the API Key as `MOBILE_RESULTS_API_KEY: $(buildkite-agent secret get DT_MOBILE_RESULTS_API_KEY)` in the plugin's inputs\n\n### `BLOCK_ON_SEVERITY` (Optional, string)\nBlock the build if vulnerabilities are found at or above the specified severity level. When set, the plugin will automatically enable polling and require `MOBILE_RESULTS_API_KEY`.\n\nSupported values:\n- `HIGH`: Block on high severity vulnerabilities only\n- `MEDIUM`: Block on medium and high severity vulnerabilities\n- `LOW`: Block on all severity vulnerabilities (low, medium, high)\n\n### `USERNAME` (Optional, string)\nUsername to be used for authenticated testing of the application. If provided, will override the previously provided value.\n\n### `PASSWORD` (Optional, string)\nPassword to be used for authenticated testing of the application. If provided, will override the previously provided value. Use of Buildkite Secrets is recommended.\n\n### `COMMENTS` (Optional, string)\nMiscellaneous, free-form comments regarding the upload.\n\n### `RELEASE_ID` (Optional, string)\nA custom ID associated with the binary being submitted, since the app version may not change very often. It is recommended that you use a unique value for this, such as the CI/CD job ID. If not set, Data Theorem will assign the binary a release_id.\n\n### `PLATFORM_VARIANT` (Optional, string)\nThe variant of the platform to use for scanning. Currently, the accepted value is `IOS_ON_MAC` (scan an iOS build on an Apple Silicon Mac instead of on an iOS device, in order to exercise code paths that are specific to Macs).\n\n### `EXTERNAL_ID` (Optional, string)\nThe external_id field represents your organization's custom identifier for the app, if any.\n\n### `WARN_ON_SEVERITY` (Optional, string)\nPrint warning messages if vulnerabilities with the specified minimum severity are found. This is a softer version of `BLOCK_ON_SEVERITY` that doesn't fail the build. This requires a Data Theorem Mobile Results API Key to be set.\n\nSupported values:\n- `HIGH`: Warn on high severity vulnerabilities only\n- `MEDIUM`: Warn on medium and high severity vulnerabilities\n- `LOW`: Warn on all severity vulnerabilities (low, medium, high)\n\n### `POLLING_TIMEOUT` (Optional, number)\nTimeout duration in seconds for polling scan results. Default is 300 seconds (5 minutes).\nThis parameter only applies when `POLL_SCAN_RESULTS` is `true`, `BLOCK_ON_SEVERITY`, or `WARN_ON_SEVERITY` is set.\n\nExample:\n```yml\nPOLLING_TIMEOUT: 600  # Wait up to 10 minutes for scan results\n```\n\n### `WAIT_FOR_STATIC_SCAN_ONLY` (Optional, boolean)\nWhen enabled, waits for the static_scan to be COMPLETED instead of the top-level scan. Default is false.\n\n### `SEVERITY_CHECK_SCOPE` (Optional, string)\nControls whether `BLOCK_ON_SEVERITY` and `WARN_ON_SEVERITY` check only findings from the current scan or all open findings in the mobile app.\n\nSupported values:\n- `CURRENT_SCAN`: Check only findings discovered in the current scan (default)\n- `ALL_ISSUES`: Check all open findings associated with the mobile app\n\nDefault: `CURRENT_SCAN`\n\nIt should look like this in your Buildkite agent secret settings\n![buildkite-data-theorem-mobile-secure-plugin-secrets.png](images%2Fbuildkite-data-theorem-mobile-secure-plugin-secrets.png)\n\n## Contributing\n\n### Running Tests\n\nTo test the plugin, use the Buildkite plugin tester:\n\n```bash\ndocker run -it --rm -v \"$PWD:/plugin:ro\" buildkite/plugin-tester\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatatheorem%2Fdata-theorem-mobile-secure-buildkite-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdatatheorem%2Fdata-theorem-mobile-secure-buildkite-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatatheorem%2Fdata-theorem-mobile-secure-buildkite-plugin/lists"}