On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.
387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Calm.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Calm
Private
2026-06-22
94d ago
Waiting
High
Calm, a meditation and sleep app millions of people pay for, hardcodes access keys directly into the app, starts a tracking system before you can even respond to its own consent screen, and, confirmed by directly tracing the app's compiled code, sends the mood you log, "anxious," "grateful," or otherwise, to nine outside companies with no check in place to stop it. Nine attempts to raise this with the company, including its named European and UK contacts, went entirely unanswered.
com.calm.android. Market-leading meditation/sleep app, paid subscription. All five findings re-scored under CVSS v4.0: nine hardcoded third-party SDK credentials incl. a live Datadog monitoring token (HIGH, corrected from an original CRITICAL label); Firebase initializing before device unlock and before the app's own consent UI can run (HIGH via blast-radius escalation); a mood check-in feature, Art. 9-adjacent mental-health data, confirmed by bytecode trace to fan out unconditionally to nine analytics vendors with zero consent branching in the dispatcher (HIGH via blast-radius escalation); a full ad-attribution stack retained on a paid product plus undisclosed Health Connect writes (corrected to MEDIUM); backup scope gap (corrected to LOW). Nine messages sent across 94 days to six named contacts, including a named EU and UK representative. Not one reply, automated or human, was ever received. Case closed and published 2026-09-24, 94 days after disclosure.
This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.