We decompile publicly distributed Android and iOS apps and trace their data flows to real endpoints in real countries. We document what we observe, distinguish verified findings from interpretation, and preserve the evidence behind every conclusion. No company can buy a better result — every organisation is held to the same standard, whether it pays us or not. This permanent disclosure ledger puts that principle into practice.
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found and documented
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Mein Magenta (AT).
OrganisationNotifiedStatusSEVIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Mein Magenta (AT)
XETRA
2026-06-26
113d ago
SUBSTANTIVE
CRITICAL
Magenta's telecom app automatically activates a live screen-sharing tool every single time it opens, on an app that displays your bills, call history and payment methods, meaning that tool is ready before you have asked for help. A Chinese advertising identifier is also given the highest priority to start before consent, and the app tracks your location and device ID from the moment your phone restarts. Magenta's DPO replied in detail on 2026-08-17, confirming three findings with technical specifics and citing server-side key restrictions. Her reply did not address a fourth finding, that Magenta's own published list of data processors names Cobrowse.io and MoEngage correctly but omits CleverTap and Nuclei CDNA Technologies, an Indian sub-processor Magenta itself describes as a joint controller, which is a third-country transfer outside the EU without an adequacy decision.
Cobrowse.io DUAL InitProvider (CobrowseInitProvider + CobrowseComposeInitProvider): live screen co-browsing SDK auto-inits at every app start - on app showing bills, call logs, payment methods. Huawei HMS AAID InitProvider (initOrder=500): Chinese advertising ID highest-priority pre-consent auto-init. 3 API keys hardcoded (Firebase, Awareness/Geofencing, Geo). CleverTap + MoEngage dual-analytics on telecom customer data. BOOT_COMPLETED + GPS geofencing + READ_PHONE_STATE (IMEI). §165 TKG 2021. BCC: DSB + RTR.
this ledger is updated in real time as companies respond. silence is public. severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius. · github.com/rfi-irfos/android-security-audit-2026
this is a useless cookie banner. it's just here to look like one * we don't use cookies, so there's nothing to consent to. don't let anyone tell you otherwise.two buttons, one closes this and throws some confetti. the other literally does nothing.