v0.6.0

v0.6.0 — Detection signals v2: 2026 sideload-lure campaigns

Detection coverage grows from 10 to 13 signals, targeting the 2026 India scam campaigns
(wedding-invite / e-challan / bill-update / KYC APKs spread over WhatsApp/Telegram) — all fully
offline, all sideload-gated.

Added

• LURE_LABEL (30 pts): a sideloaded app named like a scam bait file — "Wedding
  Invitation", "E-Challan", "Mahavitaran Bill Update", "India Post…", "KYC Update". A real
  invitation, bill, or challan is a document, never an app.
• INSTALL_PACKAGES_REQUESTED (25 pts): the app asks for permission to install other apps —
  the two-stage dropper tell used by SpyMax-style wedding-invite droppers and SecuriDropper-class
  loaders to dodge Android 13+ Restricted Settings.
• ACCESSIBILITY_DECLARED (15 pts): the manifest declares an accessibility service that
  hasn't been turned on yet — an early warning before the victim is walked into enabling it.
• A fresh wedding-invite APK sideloaded from WhatsApp, with nothing granted yet, now scores
  CRITICAL (110 points) at install time — the background watchdog can warn mid-scam, before
  the victim taps "Allow" on anything.
• 16 new unit tests (131 total), mirrored English/Hindi explanation strings, and
  docs/03-detection-rules.md rewritten for all 13 signals.

Live-tested on the Android emulator in both English and Hindi — verdict, reasons, and ranking all
confirmed correct with zero crashes.

See the changelog
for full detail.

Saavdhan works fully offline — it never declares the INTERNET permission and never connects to
any external service. Verified in this release's merged manifest.

v0.5.0

Deep architecture hardening, messenger delivery-chain detection, family share receipts, and OEM deep-link fallback chains — the largest jump in detection depth since Phase 1.

Added

• Deep architecture hardening. The risk engine moved from a boolean cascade to a continuous, point-based score (CRITICAL ≥ 80, HIGH ≥ 50, SUSPICIOUS ≥ 20). App signing certificates are checked against a hardcoded set of trusted keys as an absolute-trust override. Impersonation matching uses Levenshtein fuzzy matching plus a taskAffinity hijacking check. All Binder/PackageManager IPCs now run off the main thread.
• Scam delivery-chain detection for messengers. A new signal fires when an app's install traces back to WhatsApp, WhatsApp Business, Telegram, or another recognized messenger — the exact real-world path scam APKs travel.
• Danger reasons on the app-detail screen ranked by the engine's own point weights, most decisive first.
• Screen readers now announce the danger verdict before the app name.
• The scan is now resilient to the ~1 MB Binder reply-size limit on cheap phones with many installed apps.
• The mid-scam watchdog notification now speaks to someone being actively walked through an install by a scammer.
• "Send result to family" — an offline, timestamped share-sheet receipt so a remote family member can see what a scan found.
• A phone-health severity bar and per-app launcher icons on result cards; a complete dark-theme polish pass.
• OEM deep-link fallback chains — Device-Admin and auto-start "fix" buttons now try an ordered, per-maker chain (Samsung/Xiaomi/Oppo/Vivo/Huawei, with OnePlus/Realme/Poco/Redmi/iQOO sub-brand aliasing) instead of betting on one hardcoded screen.

Full detail: CHANGELOG.md

Fully offline, as always — no INTERNET permission, verified in the merged manifest before this release was built.

v0.4.0 — Sharper detection

What's new

• 🔴 Sharper detection: an app that fakes a system identity and holds a spy/control power (Accessibility, Device Admin, SMS, or notification access) is now flagged Very dangerous (CRITICAL) — that combination is an active banking trojan, not just a suspicious name.
• 🕵️ Harder to fool: fake-name matching now ignores punctuation, emoji, and extra spaces (e.g. "System Update!", "System‑Update ⬇️").
• 🧰 Updated build tooling (AGP 8.9.1, Kotlin 2.1.0, Compose 2025.01).

Unchanged promises: fully offline (no INTERNET permission), no ads, no account, no tracking. Free & open source (MIT).

Android 7.0+ · download the APK below or from https://kalpit.me/saavdhan

v0.3.0 — Visual hierarchy redesign

First release with the guided UX: severity banner, 'What to do now' hero card, numbered cleanup steps, risk-tinted result cards. Direct APK download now live on the landing page.

Saavdhan v0.2.0

Saavdhan (सावधान) — a free, fully-offline Android app that finds scam & spyware apps, explains the danger in plain Hindi or English, and guides removal step by step.

📲 Install: download saavdhan-v0.2.0.apk below on your Android phone (7.0+) and open it. Android will warn that the app isn't from the Play Store — that's normal for direct downloads.

What's new in 0.2.0

Added

• Watchdog v2. The background watchdog now also warns when an already-installed app gains dangerous powers (Accessibility / Device Admin / OTP access) — the real-world scam sequence where an app installs quietly and is "armed" later. Alerts fire once per upward crossing; no repeat spam.
• Slow-scan reassurance. If a scan takes more than ~8 seconds, a calm "this can take a minute" note appears.
• Scan error screen. A failed scan shows a calm bilingual "couldn't finish — try again" screen instead of crashing.
• Honest partial-scan banner. If the phone restricts which apps Saavdhan can see, results say the scan may be incomplete instead of declaring a false "all clear".

Fixed

• Closed an allowlist gap: a non-Play app faking a trusted package prefix (e.g. com.google.android.*) while holding dangerous powers is no longer trusted.
• Cleanup progress now survives Android killing the app mid-cleanup (common on low-RAM phones).
• The battery-optimization card in Settings updates immediately on return from system Settings.
• The floating coach banner auto-hides after ~2 minutes and whenever you return to the app.

---

Fully offline — the app does not hold the INTERNET permission, so it cannot make a network call. Free & open source (MIT). Landing page · Full changelog