ChessKid (US): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for ChessKid (US).
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
ChessKid (US)
Private
2026-06-24
91d ago
Waiting
Critical
ChessKid hardcodes an access key that grants full read and write access to children's behavioural data, and runs detailed analytics on kids' chess activity without ever asking a parent for consent. Chess.com never responded to a single one of eleven messages sent over three months, so this case is now closed and published on schedule, not through any engagement from the company.
A hardcoded Amplitude API key in strings.xml grants full read/write on children's behavioural data (CVSS v4.0, 9.3, CRITICAL). A Firebase key is also hardcoded, corrected on closure to MEDIUM/6.9 under CVSS v4.0 after no further exploitation path beyond the key itself was ever demonstrated. Amplitude analytics run on children's chess data with no parental consent, CVSS v4.0 base MEDIUM/6.9, held at HIGH in the final report under an explicit blast-radius escalation for the affected population, children under the age threshold GDPR Art. 8 and COPPA exist to protect. Chess.com LLC platform. Case closed and published 2026-09-23, 91 days after disclosure: 11 messages sent, 10 automated acknowledgments received, zero human reply at any point.
click to expand
GDPR Art. 32
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.