We decompile publicly distributed Android and iOS apps and trace their data flows to real endpoints in real countries. We document what we observe, distinguish verified findings from interpretation, and preserve the evidence behind every conclusion. No company can buy a better result: every organisation is held to the same standard, whether it pays us or not. This permanent disclosure ledger puts that principle into practice.
Every app is decompiled at source-code level, not just scanned from outside.
0.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
81+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
301+
Weak points found and documented
Third-party tracking we have provably found inside the binary.
176+
Endpoints investigated
Real servers and countries where data actually flows.
41+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
3 of 387 entries · sorted by elapsed ↓
Showing the report for ViCare (Viessmann), ViGuide (Viessmann), ViParts (Viessmann).
OrganisationNotifiedStatusSEVIntel (click to expand)StatutesResolvedDisclosureElapsedReport
ViCare (Viessmann)
NYSE
2026-06-30
118d ago
RESOLVED
CRITICAL
Viessmann's heating-control app starts Google tracking before your phone is even unlocked, and separately begins tracking whether anyone is home the moment your device reboots, directly contradicting the app's own privacy policy, which says this kind of tracking only happens after you consent. It also reads your location on the paid tier and discloses only two of the ten Google tracking systems actually running inside it. Viessmann's data-protection lead confirmed the findings in detail, committed to a concrete fix, and reported the case to the German regulator on his own initiative. RESOLVED 2026-10-26: Viessmann confirmed within two days, notified the Hessian DPA itself (02.07. and 28.07.) and shipped fixes for all three apps. RFI-IRFOS re-verified ViCare 3.41.3, ViGuide 2.24.13 and ViParts 1.11.4 on 26.10.2026: consent-first Firebase via Usercentrics and Consent Mode v2, keys rotated, cleartext and gateway key removed. Two minor ViGuide strings remain (KPIT host, password toString). Best vendor response of the 2026 programme.
com.viessmann.vicare v3.39.0. Viessmann Climate Solutions / Carrier Global (NYSE: CARR) - heating-system control app, millions of EU users. C1: 2× Firebase API keys hardcoded (AIzaSyCfv8TY2O7dPsWPdU3X4R2LqYj6KtxtrW0 + AIzaSyDgmW4ZMvNblSXqMOgsbY8uRrTnfR3E7pY). C2: FirebaseInitProvider (directBootAware=true, initOrder=100) initialises Firebase before any consent screen and before device unlock, plus a GeofencingSystemBootReceiver (BOOT_COMPLETED, exported=true) starting home-presence tracking at device boot, before the app is even opened - the binary structurally contradicts the privacy policy's consent-based-Firebase claim (Art. 7). ACCESS_BACKGROUND_LOCATION on the paid Geofencing tier. H1-H3: AD_ID + ADSERVICES_ATTRIBUTION on a heating-control app, 10 Firebase subsystems with only 2 disclosed in the privacy policy. Best incoming response of the entire 2026 series: Head of Data Protection Daniel Hernstein-von Glahn replied point by point, fully confirmed C2 with exact technical detail (default events, FCM token, FID generation, Remote Config pre-consent), committed a concrete fix (Consent Mode v2 default DENIED + setAnalyticsCollectionEnabled(false)), and proactively notified the lead supervisory authority (HBDI, Hesse) on 2026-07-02 with the case CC'd on the record - genuine Art. 33-adjacent conduct, not just words. Reasoned, evidence-based pushback accepted on parts of C1 (FCM-phishing needs a server key the client key alone can't provide; ViCare doesn't use Firebase Auth so user-enumeration doesn't apply). R1 sent 2026-06-30, embargo 2026-09-28. Same rigor now extending to sibling apps ViGuide and ViParts.
This Viessmann technician app, which anyone can download from the Play Store even though it is meant only for professional partners, starts Google and machine-learning tracking within seconds of opening it, before you have agreed to anything, and allows unencrypted connections to any domain with no restriction. Technicians using it capture customer addresses, precise locations and appliance serial numbers, all covered only by a generic privacy policy that was never written for this specific use. RESOLVED 2026-10-26: Viessmann confirmed within two days, notified the Hessian DPA itself (02.07. and 28.07.) and shipped fixes for all three apps. RFI-IRFOS re-verified ViCare 3.41.3, ViGuide 2.24.13 and ViParts 1.11.4 on 26.10.2026: consent-first Firebase via Usercentrics and Consent Mode v2, keys rotated, cleartext and gateway key removed. Two minor ViGuide strings remain (KPIT host, password toString). Best vendor response of the 2026 programme.
com.viessmann.vizard.presentation.release (internal codename "Vizard"). Viessmann Climate Solutions / Carrier Global (NYSE: CARR) - the field-technician commissioning and diagnostic app for Viessmann heating/heat-pump equipment, publicly downloadable on the Play Store though scoped by Viessmann to professional Fachpartner use. C1: Firebase API key hardcoded (project vizard-ace22). C2: FirebaseInitProvider + MlKitInitProvider (directBootAware, initOrder=100/99) fire before any consent interaction, the same pre-consent pattern already confirmed for ViCare - independently reproduced by RFI-IRFOS via a public, non-partner download outside any business relationship, tracking began within seconds of first launch. H1: cleartextTrafficPermitted=true with no domain restriction at all, broader than ViCare's DoIP-scoped exception. H2: a licensing/consent backend ("Limas") hardcoded across 3 hostnames including a KPIT Technologies domain - Viessmann has since confirmed a signed Art. 28 agreement with KPIT Munich and states the call path is dead code slated for removal. H3: technician-captured customer address, geolocation and appliance serials under only a generic, non-app-scoped privacy policy. Genuinely good: a real, binary-confirmed blocking consent gate exists (the app itself refuses to launch without acceptance), the ContentProviders simply init ahead of it; no ACCESS_BACKGROUND_LOCATION, a working GDPR-deletion flow, zero Bluetooth attack surface. R1 sent 2026-07-02 jointly with ViParts, embargo 2026-09-30. Interim technical response received 2026-07-09 with a full finding-mapping table against the already-confirmed ViCare findings.
Viessmann's parts-ordering app handles consent more carefully than its sister apps, with tracking switched off by default, but it still leaves three access keys hardcoded in the app together with internal staging server addresses, and lets your phone back up its full data with no restrictions. That means better tracking discipline paired with weaker protection of the credentials behind it. RESOLVED 2026-10-26: Viessmann confirmed within two days, notified the Hessian DPA itself (02.07. and 28.07.) and shipped fixes for all three apps. RFI-IRFOS re-verified ViCare 3.41.3, ViGuide 2.24.13 and ViParts 1.11.4 on 26.10.2026: consent-first Firebase via Usercentrics and Consent Mode v2, keys rotated, cleartext and gateway key removed. Two minor ViGuide strings remain (KPIT host, password toString). Best vendor response of the 2026 programme.
com.viessmann.viparts. Viessmann Climate Solutions / Carrier Global (NYSE: CARR) - spare-parts lookup and B2B ordering app for dealers, service partners and technicians, a Capacitor/OutSystems hybrid rather than native like its siblings. C1: 3 hardcoded Firebase/Google keys (project vi-its-viparts-prod). H1: the same FirebaseInitProvider pre-consent mechanism as ViCare and ViGuide, but genuinely mitigated by default-off analytics and a real JS-side Consent Mode v2 gate that neither sibling app has. M1: a proprietary backend gateway key hardcoded in client-side JavaScript. M2: staging/integration URLs live in the production bundle. M3: allowBackup=true with no extraction rules. IAM login redirect uses a custom URL scheme rather than a domain-verified Android App Link; PKCE usage could not be confirmed or ruled out from static analysis alone. Net picture: better consent discipline than its siblings, weaker secret hygiene. R1 sent 2026-07-02 jointly with ViGuide, embargo 2026-09-30. Interim technical response received 2026-07-09.
this ledger is updated in real time as companies respond. silence is public. severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius. · github.com/rfi-irfos/android-security-audit-2026