Path to the app binary to scan, relative to the workspace: .apk, .aab, .ipa (also .xapk/split bundles). Wildcards are allowed but must match exactly one file, e.g. app/build/outputs/apk/release/*.apk.

Required unless Artifactory URL is set. When both are set, the binary is not uploaded; its SHA-256 is sent as the Artifact SHA-256 so the scan is tied to the exact file this build produced.