We decompile publicly distributed Android and iOS apps and trace their data flows to real endpoints in real countries. We document what we observe, distinguish verified findings from interpretation, and preserve the evidence behind every conclusion. No company can buy a better result — every organisation is held to the same standard, whether it pays us or not. This permanent disclosure ledger puts that principle into practice.
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found and documented
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Österr. Lotterien.
OrganisationNotifiedStatusSEVIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Österr. Lotterien
PUBLIC
2026-06-20
119d ago
RESOLVED
CRITICAL
Austria's state-run lottery actively instructs its entire user base, including elderly and technically inexperienced players, to disable one of Android's core anti-malware protections just to get the app's full functionality, while also hardcoding a database access key and running a full stack of undisclosed advertising and marketing trackers, including on a gambling platform where re-engagement marketing sits in tension with the operator's own responsible-gambling duties. Six attempts to raise this over four months drew only automated acknowledgments, never a substantive reply from any named person at the state lottery.
at.lotterien.app v4.7.0. Austrian state lottery (≥90% state-owned). 7 findings (2C+5H), case closed and published 2026-10-17, 28 days after the 2026-09-19 embargo. C1: the app instructs users to enable "install from unknown sources" to sideload the full version, bypassing Play Protect, on a platform used disproportionately by elderly and technically inexperienced players. C2: a production Firebase key hardcoded (project gluecksbote-c9560). 5 further HIGH findings: a full Facebook SDK incl. Gaming Services and a production-present debug interceptor, all four Privacy Sandbox ad permissions simultaneously, undisclosed fine-location collection, dual Adjust+Adform attribution SDKs, and Salesforce Marketing Cloud behavioral CRM. Six messages sent across two threads over 119 days; the only responses received were three generic autoresponses from help@lotterien.at; no substantive reply was ever received from any named person.
this ledger is updated in real time as companies respond. silence is public. severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius. · github.com/rfi-irfos/android-security-audit-2026
this is a useless cookie banner. it's just here to look like one * we don't use cookies, so there's nothing to consent to. don't let anyone tell you otherwise.two buttons, one closes this and throws some confetti. the other literally does nothing.