Diagnosia, a professional drug-reference app, confirmed initializing Firebase and Sentry before any consent screen renders, and has since gated the parts of that initialization that generated an actual token or analytics event, on a tool whose lookup history implies patient conditions being treated (Art. 9 by inference).
Firebase + Sentry pre-consent ContentProvider auto-init CONFIRMED (Leitner reply 2026-08-13 did not dispute these providers): com.google.firebase.provider.FirebaseInitProvider + io.sentry.android.core.SentryInitProvider / SentryPerformanceProvider fire on process start, pre-consent, on a medical drug-lookup app. Correction: the original headline stated this as confirmed third-party tracking. The operator repeatedly asked for a concrete transmission proof, endpoint, timing, data category, which RFI-IRFOS never supplied, only the confirmed pre-consent initialization timing. The claim is corrected to what is actually verified, SDK initialization before consent, not a confirmed data transfer. Partial remediation confirmed live 2026-09-21 against a freshly pulled build: io.sentry.auto-init=false (since v7.1.1) and firebase_messaging_auto_init_enabled=false plus firebase_analytics_collection_enabled=false (since v7.1.2) stop the automatic Sentry init path and the automatic FCM registration respectively; the bare ContentProviders still register and still initialize unconditionally at process start, so pre-consent SDK bootstrap continues, but automatic token generation and analytics collection are now gated. Facebook SDK claim WITHDRAWN 2026-08-13: com/facebook/… smali traced to React Native (com.facebook.react), not an embedded Meta SDK. C2 (search-history backup) WITHDRAWN 2026-08-14: both secure_store_backup_rules.xml and secure_store_data_extraction_rules.xml scope to the sharedpref domain only (SecureStore sub-path excluded); the app persists via Room/expo-sqlite (database domain), which neither rule includes. RFI-IRFOS's original report had already quoted the rule correctly but overreached in its conclusion; withdrawn in full. Firebase API key (AIzaSy…bLZA, project diagnosia-android) hardcoded and confirmed unrotated, byte-identical since the original June audit; the operator's claimed Application/API restriction, package name plus SHA-1 binding, limited to the FCM Registration, Firebase Cloud Messaging and Firebase Installations APIs, is now independently confirmed, both from a live-supplied console screenshot and from the same key value re-extracted from the current binary. Of ten originally-listed abuse paths, eight require Firebase SDKs (Firestore/Storage/Auth/Functions/Remote Config) that are absent from the binary and were withdrawn 2026-08-14; FCM token/quota abuse remains structurally possible, and Firebase App Check is not integrated anywhere in the app (zero client-integrity gate). Operator corrected: Österreichische Apotheker-Verlagsgesellschaft m.b.H. (Vienna), successor by merger to the originally-named Diagnosia Internetservices GmbH (merged 2021-09-01). BCC: DSB + BMG. Case closed 2026-09-22: all three closure conditions RFI-IRFOS itself named on 2026-09-16, verified key restriction, verified FCM auto-init gating, verified Sentry auto-init gating, are independently confirmed. FCM token enumeration, the US CLOUD Act third-country question, and the Art. 9 classification of search history remain on record as RFI-IRFOS's own ongoing observations, not as findings still blocking closure against the current build. Severity corrected from CRITICAL to MEDIUM at closure: the two findings that justified CRITICAL, H3 (Facebook/Meta SDK) and C2 (search-history backup exposure), were both withdrawn in full, and C1, the one finding that stands, scores MEDIUM under CVSS v4.0 (6.9) in RFI-IRFOS's own final report. No standing finding in this case supports a CRITICAL rating any longer.
click to expand