How openbin-ai/platform works
Purpose and entry points
OpenAPK/OpenBin is a self-hostable collaborative security-research platform: OpenAPK analyzes Android APKs; OpenBin analyzes native binaries and scripts. Users access React SPAs, authenticate through OIDC, upload or attach analysis artifacts, inspect decompiled code, use BYOK LLM features, and create/share reports. Runtime entry points are core/src/main/java/ai/openapk/core/CoreApplication.java, openapk-frontend/src/main.tsx, openbin-frontend/src/main.tsx, and CLI cli/main.go.
API core and security boundary
core/ is the central Java Spring Boot service and REST API. Controllers expose domain operations; services coordinate persistence, storage, workers, and LLMs. OAuth2 resource-server security validates bearer JWTs from Keycloak; current-user provisioning and authorization gates isolate private projects, while explicit public-read routes expose shared artifacts.
Paths: core/src/main/java/ai/openapk/core/config/SecurityConfig.java, core/src/main/java/ai/openapk/core/auth/CurrentUserService.java, core/src/main/java/ai/openapk/core/projects/ProjectAccessGuard.java.
Project ingestion, storage, and decompilation
Projects are the primary aggregate for uploaded APKs, binaries, and related derived artifacts. Ingestion is staged as initiate/finalize requests, then delegates decompilation or analysis. A storage abstraction keeps application services independent of local filesystem versus S3-backed source-of-truth; S3 uses a local cache and signed media URLs.
Paths: core/src/main/java/ai/openapk/core/projects/ingest/IngestService.java, core/src/main/java/ai/openapk/core/projects/storage/ProjectStorage.java, core/src/main/java/ai/openapk/core/projects/JadxDecompileService.java.
Isolated analysis workers
The core invokes separate containerized workers for expensive or tool-specific analysis. JADX produces Android decompilation; Ghidra handles native ELF/PE/Mach-O workflows and ingestion; Lambda-oriented workers analyze scripts, PyPI packages, and shell artifacts. Worker execution is asynchronous/quotable and materializes outputs back into project storage and database metadata.
Paths: jadx-worker/app/main.py, ghidra-worker/app/main.py, core/src/main/java/ai/openapk/core/nativeanalysis/NativeAnalysisRunner.java, script-worker/src/handler.js.
Research views and derived indexes
Backend modules turn stored analysis outputs into navigable research data: symbols/usages, call chains, manifests, JNI bridges, network and crypto indicators, database schemas, deobfuscation/renames, highlights, and search. These are project-scoped read/write APIs over analysis files plus relational metadata, rather than independent data pipelines.
Paths: core/src/main/java/ai/openapk/core/symbols/SymbolService.java, core/src/main/java/ai/openapk/core/callchain/CallChainService.java, core/src/main/java/ai/openapk/core/analysis/StaticDigestService.java.
AI, credentials, and governance
Users store encrypted provider credentials for Anthropic, OpenAI, or Bedrock. LLM calls build prompts from project artifacts, support streaming, audit usage, and enforce user/worker limits. AI also drives Q&A, deobfuscation, rename suggestions, call-chain narration, crypto reconstruction, and script findings.
Paths: core/src/main/java/ai/openapk/core/credentials/LlmCredentialEncryptionService.java, core/src/main/java/ai/openapk/core/analysis/LlmInvoker.java, core/src/main/java/ai/openapk/core/usage/LlmUsageService.java.
Collaboration and presentation clients
Two Vite/React clients specialize the common API for APK and binary workflows, reusing auth/API/components under shared/; a third Vite app is the OpenBin landing site. Projects support collaborators, presence, annotations/highlights, reports/templates, community publication, follows, votes, comments, notifications, and public views. The Go CLI automates authentication, uploads, decompilation, and native attachment.
Paths: openapk-frontend/src/pages/ProjectView.tsx, openbin-frontend/src/pages/ProjectViewRoute.tsx, shared/components/CommentsThread.tsx, cli/cmd_root.go.
Infrastructure and persistence
Postgres stores users, projects, credentials, reports, social data, job/usage records, and indexes, evolved through Flyway migrations. Docker Compose supplies Postgres, Keycloak with imported realm/theme, and optional MinIO for S3-compatible testing. Production storage integrates AWS S3/CloudFront; LLM providers and worker/Lambda invocations are external service boundaries.
Paths: core/compose.yaml, core/src/main/resources/db/migration/V1__init.sql, core/src/main/java/ai/openapk/core/projects/analysis/CloudFrontUrlSigner.java.
Main entry points: CoreApplication.java Core REST API · ProjectStorage.java Project Storage · IngestService.java Project Ingestion · SymbolService.java Research Views & Indexes
Components 20
Clients
- OpenAPK React SPA · APK research workspace.
openapk-frontend/src/main.tsx - OpenBin React SPA · Native-binary research workspace.
openbin-frontend/src/main.tsx - Go CLI · Authenticates, uploads, and starts analysis.
cli/main.go
Spring Boot Core
- Core REST API · Central domain API and orchestration runtime.
core/src/main/java/ai/openapk/core/CoreApplication.java - JWT Security · Validates OIDC bearer tokens and protects routes.
core/src/main/java/ai/openapk/core/config/SecurityConfig.java - Project Access · Provisions current users and enforces project isolation.
core/src/main/java/ai/openapk/core/projects/ProjectAccessGuard.java - Project Ingestion · Initiates/finalizes artifacts and dispatches analysis.
core/src/main/java/ai/openapk/core/projects/ingest/IngestService.java - Project Storage · Abstracts local or S3-backed artifacts and derived outputs.
core/src/main/java/ai/openapk/core/projects/storage/ProjectStorage.java - Native Analysis Runner · Dispatches native analysis asynchronously.
core/src/main/java/ai/openapk/core/nativeanalysis/NativeAnalysisRunner.java - Research Views & Indexes · Serves symbols, call chains, indicators, search, and derived metadata.
core/src/main/java/ai/openapk/core/symbols/SymbolService.java - AI Analysis · Builds artifact-grounded prompts and streams research features.
core/src/main/java/ai/openapk/core/analysis/LlmInvoker.java - Credentials & Usage · Encrypts BYOK credentials and enforces/audits LLM limits.
core/src/main/java/ai/openapk/core/credentials/LlmCredentialEncryptionService.java - Reports & Collaboration · Provides annotations, reports, publication, and social activity.
Isolated Workers
- JADX Worker · Decompiles Android APKs.
jadx-worker/app/main.py - Ghidra Worker · Analyzes ELF, PE, and Mach-O artifacts.
ghidra-worker/app/main.py - Script Worker · Analyzes scripts, packages, and shell artifacts.
script-worker/src/handler.js
Identity, Data & External Services
- Keycloak · Issues JWTs for platform users.
core/compose.yaml - Postgres · Stores project, user, report, social, job, usage, and index metadata.
core/src/main/resources/db/migration/V1__init.sql - Object Storage · Source of truth for uploaded artifacts and worker outputs.
- LLM Providers · Anthropic, OpenAI, and Bedrock provider boundary.
Connections 25
- OpenAPK React SPA → Core REST API: REST API
- OpenBin React SPA → Core REST API: REST API
- Go CLI → Core REST API: automates API
- Core REST API → JWT Security: secures requests
- JWT Security → Keycloak: validates JWTs
- Core REST API → Project Access: authorizes project routes
- Core REST API → Project Ingestion: uploads and attachments
- Project Ingestion → Project Storage: stores artifacts
- Project Ingestion → JADX Worker: APK jobs
- Project Ingestion → Native Analysis Runner: native jobs
- Project Ingestion → Script Worker: script jobs
- Native Analysis Runner → Ghidra Worker: dispatches
- JADX Worker → Project Storage: materializes outputs
- Ghidra Worker → Project Storage: materializes outputs
- Script Worker → Project Storage: materializes outputs
- Project Storage → Object Storage: local or S3 backend
- Core REST API → Research Views & Indexes: research APIs
- Research Views & Indexes → Project Storage: reads analysis files
- Core REST API → AI Analysis: AI features
- AI Analysis → Credentials & Usage: credentials and limits
- AI Analysis → LLM Providers: provider calls
- Core REST API → Reports & Collaboration: reports and sharing
- Core REST API → Postgres: domain persistence
- Research Views & Indexes → Postgres: derived metadata
- Credentials & Usage → Postgres: encrypted credentials and usage