Doctolib: Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

We run an agentic AI pipeline that decompiles publicly distributed Android and iOS apps, investigates their code and data flows, and traces connections to real-world endpoints. Hundreds of specialised agents work across the investigation, connecting technical evidence into a coherent picture that human specialists review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Doctolib.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Doctolib
Private
2026-08-04
90d ago
ACK
Critical
Doctolib's app, which holds appointment and health information for tens of millions of patients, starts a third-party survey and analytics tool at the highest possible priority, before the app's own cookie banner has had a chance to ask anything, so the tool is running before consent is recorded. The app also ships a Firebase configuration with an API key in its production build, which Doctolib disputes is a secret, and it left a clipboard component open to other apps on the phone, which Doctolib has now removed. Doctolib spotted and corrected a date error in the disclosure itself, precisely and in good faith, and after an initial delay answered the technical questions on 2026-09-10.
fr.doctolib.www v5.8.1, sha-256 2d7ac65e5060d49ddbdaafcad5cc31467d89169495b0fd581484077b7c0669b5. Doctolib SAS / Doctolib GmbH, appointment booking and health records for patients and practitioners across France and Germany. Screeb SDK v3.1.1 initialises through ScreebInitProvider.onCreate() calling initSdkWithContextOnly(context) at initOrder=2147483647, the maximum value Android accepts, placing it ahead of MainActivity and ahead of the app's own Didomi consent layer; egress to r.screeb.app/rpc/1.3.0/l documented in a/m.java, no consent gate present in the decompile (Art. 7(1)). Hardcoded Firebase key in strings.xml, project doctolib-dabf0, shipped in the production binary (Art. 32). expo.modules.clipboard.ClipboardFileProvider exported="true" with no permission guard, verified with aapt2. Seven SDK families verified in the 5.8.1 binary: Firebase Messaging, Datadog, Adjust, Sentry, ML Kit, Screeb, Didomi. Doctolib confirmed on 2026-09-10 that the nine further SDKs named in our first report are not present. R1 sent 2026-08-04. Doctolib caught a genuine error in that first disclosure: it stated the campaign-wide date of 2026-09-01 rather than ninety days from notification. Their calculation of 2026-11-02 was correct and RFI-IRFOS corrected it in writing the same day, setting 2026-08-18 as an engagement checkpoint inside the window. That checkpoint passed on 2026-08-18 without a substantive answer. Doctolib answered the four questions on 2026-09-10 and confirmed that Screeb initialises at process start before consent. On 2026-11-02 Doctolib reported Screeb 4.4.1 and the clipboard fix live in production and disputes that the Firebase key is a secret. Our check of the 5.17.0 build confirms the clipboard fix and shows the native Screeb provider still runs without a consent check, though it does not start the WebView without a channel ID. The consent check on the JavaScript side could not be verified. cnil@cnil.fr, the lead authority address, hard-bounced 550 5.1.1 on 2026-08-04; verification against the CNIL's own contact page on 2026-08-18 confirmed the CNIL publishes no email address at all.
click to expand
-
No
0d 00h 00m 00s
Disclosure
90d 15h 43m 04s
Days silent
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.