We decompile publicly distributed Android and iOS apps and trace their data flows to real endpoints in real countries. We document what we observe, distinguish verified findings from interpretation, and preserve the evidence behind every conclusion. No company can buy a better result — every organisation is held to the same standard, whether it pays us or not. This permanent disclosure ledger puts that principle into practice.
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found and documented
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for idealo.
OrganisationNotifiedStatusSEVIntel (click to expand)StatutesResolvedDisclosureElapsedReport
idealo
PRIVATE
2026-06-30
109d ago
RESOLVED
CRITICAL
idealo, a price-comparison app you actively use to type in what you want to buy, builds an advertising profile from your search queries, product interests and price range and shares it with Facebook and a marketing platform before you have given consent. An internal component of the app is also left open to other apps on your phone, so a completely unrelated app could wake it up and trigger tracking, and the address of the live database is hardcoded directly into the app's code.
de.idealo.android. idealo internet GmbH, Berlin (Axel Springer, ~50M MAU). C1: Firebase API Key AIzaSyCEfD… + production DB api-project-966339893929.firebaseio.com hardcoded. H1: ACCESS_ADSERVICES_CUSTOM_AUDIENCE - Protected Audiences API builds interest groups from search queries (product and price range) for cross-app ad retargeting, combined with Braze CRM and Facebook SDK for a complete behavioral ad stack on a purchase-intent platform. H2: FirebaseInitProvider (initOrder=100) + Adjust pre-consent ContentProvider + BOOT_COMPLETED. H3: SendIntentBroadcastReceiver exported=true with no permission protection, external apps can trigger tracking. + Storyly, Qualtrics, GrowthBook reserved. R1 sent 2026-06-30. BlnBDI in CC. Embargo 2026-09-28. Deadline 2026-07-14. idealo: disclosed 2026-06-30, 6 messages over 109 days, one non-substantive blanket rejection on 2026-07-03 naming no finding, then 106 days of silence, published 2026-10-17, 19 days past the 2026-09-28 embargo.
this ledger is updated in real time as companies respond. silence is public. severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius. · github.com/rfi-irfos/android-security-audit-2026
this is a useless cookie banner. it's just here to look like one * we don't use cookies, so there's nothing to consent to. don't let anyone tell you otherwise.two buttons, one closes this and throws some confetti. the other literally does nothing.