feat: expand regex-powered mobile auditor coverage

Add regex-based scan messaging to APK/IPA auditor pages, wire IPA findings to import APX regex signatures, and document the new mobile analysis capabilities in README for the v4.2.0 release.

Made-with: Cursor

Author: h0tak88r

README.md

@@ -34,9 +34,9 @@ Results are automatically uploaded to **Cloudflare R2 storage** and linked direc
 | ☁️ **S3 Buckets**      | Enumerate and scan AWS S3 buckets for exposure and misconfig                                                                           |
 | 🔗 **JavaScript**      | Extract secrets, API endpoints, auth tokens from JS files                                                                              |
 | 🐙 **GitHub Recon**    | Org-level and repo-level scanning for secrets, dependency confusion                                                                    |
-| 📱 **APK Auditor**     | Browser-based static analysis: decompile DEX, 80+ OWASP rules, tracker detection, manifest parsing, cert analysis, MASVS export. (Based on [apkauditor](https://github.com/thecybersandeep/apkauditor) by @thecybersandeep) |
+| 📱 **APK Auditor**     | Browser-based Android analysis: DEX decompiler, manifest + cert parsing, tracker detection, MASVS mapping, and regex-driven findings with APX secret patterns. (Based on [apkauditor](https://github.com/thecybersandeep/apkauditor) by @thecybersandeep) |
 | 🔒 **MITM Patch**      | Fetch any Android app by Package ID → auto-patch `network_security_config.xml` → re-sign → R2 download link in one click             |
-| 📱 **IPA Auditor**     | Browser-based iOS IPA analysis: binary strings, plist parsing, secrets detection, framework fingerprinting. (Based on [ipaauditor](https://github.com/thecybersandeep/ipaauditor) by @thecybersandeep) |
+| 📱 **IPA Auditor**     | Browser-based iOS IPA analysis: plist + Mach-O inspection, binary strings extraction, and findings tab powered by 200+ regex signatures plus MASVS-style rules. (Based on [ipaauditor](https://github.com/thecybersandeep/ipaauditor) by @thecybersandeep) |
 | 🖥️ **ADB Auditor**    | Browser-based ADB security tool: USB device inspection, app enumeration, logcat tailing, file pull, activity launching. (Based on [adbauditor](https://github.com/thecybersandeep/adbauditor) by @thecybersandeep) |
 | ⚙️ **Misconfigs**      | 100+ service misconfiguration checks                                                                                                   |
 | 🏴‍☠️ **BB Scope**     | Fetch scope from HackerOne, Bugcrowd, Intigriti, YesWeHack (token), Immunefi — CLI & **dashboard Targets page**                       |
@@ -208,11 +208,12 @@ autoar aem scan        -d <domain>            Detect AEM instances and test vuln
 The **APK Auditor** is a fully browser-based static analysis tool available at `/ui/apkauditor/`.
 
 **Drag & Drop Analysis (no server required):**
-- Drop any APK to instantly decompile DEX and run 80+ security rules in the browser
+- Drop any APK to instantly decompile DEX and run regex-based findings in the browser
 - Parsed binary AndroidManifest (exported components, permissions, SDK, backup flags, deep links)
 - Certificate analysis (debug keys, expired certs, weak algorithms)
 - 38+ tracker & SDK detection from DEX strings
 - Full in-browser file explorer (XML, JSON, images, .so files with hex view)
+- Regex presets and bulk pattern scans for secrets/tokens across code and resources
 - OWASP MASVS aligned reporting — one-click export
 
 **Remote Fetch by Package ID (server-side, with MITM patch):**
@@ -248,6 +249,23 @@ autoar apkx scan       -i <apk_or_ipa_path>  Analyze a local APK or IPA file
 autoar apkx mitm       -i <apk_path>          Patch APK for MITM traffic analysis
 ```
 
+### Mobile Application Analysis (IPA Auditor)
+
+The **IPA Auditor** is a browser-based iOS static analysis tool available at `/ui/ipaauditor/`.
+
+**What it covers:**
+- IPA parsing in-browser (no upload required for local analysis)
+- Info.plist extraction, URL schemes, entitlement/permission indicators
+- Mach-O binary string extraction with security pattern matching
+- Findings tab generated from:
+  - native iOS security rules (ATS, storage, crypto, webview/runtime checks)
+  - regex preset secret scans
+  - imported APX regex signatures from APK Auditor (200 patterns)
+- Combined findings coverage is now 200+ regex signatures plus core iOS rules
+- Explorer mode for source/resources with line-level finding navigation
+
+> **Important:** Auditor findings are signatures for triage and manual validation, not guaranteed exploitability.
+
 ### Dependency Confusion
 
 ```
@@ -788,13 +806,13 @@ For PostgreSQL, ensure:
 
 ## 🏷️ GitHub release (tag → CI)
 
-Versions are defined once in `[internal/version/version.go](internal/version/version.go)` (`Version`, no `v` prefix). To publish **v4.0.0**:
+Versions are defined once in `[internal/version/version.go](internal/version/version.go)` (`Version`, no `v` prefix). To publish **v4.2.0**:
 
-1. Set `const Version = "4.0.0"` and commit.
+1. Set `const Version = "4.2.0"` and commit.
 2. From the repo root:
   ```bash
    chmod +x scripts/tag-release.sh
-   ./scripts/tag-release.sh v4.0.0
+   ./scripts/tag-release.sh v4.2.0
   ```
    This pushes your current branch and the annotated tag. `**[.github/workflows/release.yml](.github/workflows/release.yml)**` then builds Linux binaries, attaches `tar.gz` / `zip`, generates release notes, and pushes `**ghcr.io/<owner>/autoar**` for that tag.
 

internal/api/ui/apkauditor/index.html

@@ -429,7 +429,7 @@
     <main>
         <div id="landingContent">
             <section class="hero">
-                <div class="hero-badge">Android Security Scanner · 100% In-Browser</div>
+                <div class="hero-badge">Android Security Scanner · Regex-Based Scans · 100% In-Browser</div>
                 <h1 class="hero-title">Analyze Any <span class="gradient">Android APK</span><br>In Seconds</h1>
                 <p class="hero-subtitle">Drop an APK to decompile DEX, perform regex-based security scans, parse manifests and certs. Nothing leaves your browser.</p>
                 <div class="hero-actions">
@@ -459,7 +459,7 @@ <h1 class="hero-title">Analyze Any <span class="gradient">Android APK</span><br>
                     <span class="fmt-badge">AndroidManifest.xml</span>
                     <span class="fmt-badge">DEX Decompiler</span>
                     <span class="fmt-badge">Certificate Analysis</span>
-                    <span class="fmt-badge">280+ Security Rules</span>
+                    <span class="fmt-badge">280+ Regex Security Rules</span>
                 </div>
             </div>
 
@@ -502,7 +502,7 @@ <h2 style="font-size:20px;font-weight:700;">Remote Package Analysis</h2>
             </div>
                     <div class="feature-card">
                         <div class="feature-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg></div>
-                        <div class="feature-title">280+ Android Security Rules</div>
+                        <div class="feature-title">280+ Regex-Based Android Security Rules</div>
                         <div class="feature-desc">Regex-based static analysis for hardcoded keys, secrets, weak crypto, HTTP endpoints, exported components, and more.</div>
                     </div>
                     <div class="feature-card">

internal/api/ui/ipaauditor/index.html

@@ -517,9 +517,9 @@
     </header>
 
     <main class="hero" id="landingContent">
-        <div class="hero-badge">Comprehensive iOS Security Analysis</div>
+        <div class="hero-badge">Comprehensive iOS Security Analysis · Regex-Based Scans</div>
         <h1 class="hero-title"><span class="gradient">IPA Auditor</span></h1>
-        <p class="hero-subtitle">Professional iOS security auditing platform. Analyze IPA files entirely in your browser with 50+ security checks based on OWASP MASVS.</p>
+        <p class="hero-subtitle">Professional iOS security auditing platform. Analyze IPA files entirely in your browser with regex-based secret scanning and OWASP MASVS-aligned checks.</p>
         <div class="hero-actions">
             <button class="btn btn-primary" onclick="document.getElementById('fileInput').click()"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M21 15v4a2 2 0 01-2 2H5a2 2 0 01-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/></svg>Upload IPA</button>
         </div>
@@ -552,7 +552,7 @@ <h1 class="hero-title"><span class="gradient">IPA Auditor</span></h1>
             <div class="dropzone-title">Drag & Drop IPA File</div>
             <div class="dropzone-desc">or click anywhere to browse</div>
             <div class="dropzone-formats">
-                <span class="format-tag"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="vertical-align: middle; margin-right: 4px;"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>Secure Analysis</span>
+                <span class="format-tag"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="vertical-align: middle; margin-right: 4px;"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>Regex Security Scan</span>
                 <span class="format-tag">.ipa</span>
                 <span class="format-tag">iOS App</span>
             </div>
@@ -567,7 +567,7 @@ <h2 class="section-title">Static Security Scanner</h2>
             <p class="section-desc">Pattern-based security analysis for iOS applications. Scans IPA contents and flags potential security issues for manual review.</p>
         </div>
         <div class="features-grid">
-            <div class="feature-card"><div class="feature-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg></div><div class="feature-title">Security Scan</div><div class="feature-desc">Scans all files for 50+ vulnerability patterns including ATS misconfigurations, insecure storage, weak cryptography, and hardcoded secrets.</div></div>
+            <div class="feature-card"><div class="feature-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg></div><div class="feature-title">Security Scan</div><div class="feature-desc">Regex-based scanning across source files and extracted binary strings for secrets, insecure configs, ATS issues, weak crypto, and hardcoded credentials.</div></div>
             <div class="feature-card"><div class="feature-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="16 18 22 12 16 6"/><polyline points="8 6 2 12 8 18"/></svg></div><div class="feature-title">Binary Analysis</div><div class="feature-desc">Extracts strings from Mach-O executable and checks for PIE, ARC, Stack Canary, and 64-bit compilation.</div></div>
             <div class="feature-card"><div class="feature-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="11" width="18" height="11" rx="2"/><path d="M7 11V7a5 5 0 0110 0v4"/></svg></div><div class="feature-title">Pattern Matching</div><div class="feature-desc">Searches for weak crypto usage (MD5, SHA1, DES), hardcoded secrets, API keys, and sensitive strings.</div></div>
             <div class="feature-card"><div class="feature-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M14 2H6a2 2 0 00-2 2v16a2 2 0 002 2h12a2 2 0 002-2V8z"/><polyline points="14 2 14 8 20 8"/></svg></div><div class="feature-title">File Inspection</div><div class="feature-desc">Lists all files in the IPA bundle including plists, databases, certificates, and embedded resources.</div></div>