VOL.at (at.vol.android): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for VOL.at.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
VOL.at
Private
2026-06-29
82d ago
Waiting
Critical
VOL.at still ships a push-notification SDK so controversial that the US Army removed apps using it, and Russmedia's own newsroom reported on that very story, yet the SDK remains active in Russmedia's own app. The app also allows unencrypted connections everywhere, runs a hidden overlay tool that can draw over your screen, and sends your reading behaviour to US servers where it falls under US surveillance law. Most seriously, the app is coded to switch consent off for an advertising SDK by default, meaning the choice you think you are making about tracking is not actually being respected.
10 findings (4 CRITICAL / 3 HIGH / 3 MEDIUM). C1: Pushwoosh BootReceiver still shipping versionCode 389 - US Army removed apps for this SDK, Russmedia's own newsroom reported the Reuters/Pushwoosh story via APA on 2022-11-14 (documented Kenntnis, Art. 83(2)(b)). C2: Firebase API key + global cleartext NSC base-config. C3: Russmedia DebugConsole OverlayService (SYSTEM_ALERT_WINDOW) active in production. C4: Chartbeat SDK with hardcoded AWS Cognito Identity Pool (us-east-1:89109093-5e56-4960-928b-5edc0e63a985) - behavioral data to US-EAST-1, CLOUD Act jurisdiction. H2: StartApp CONSENT_ENABLED=false - consent mechanism programmatically bypassed by Russmedia (Art. 7 intentional violation). R1 sent 2026-06-29. DSB + CERT.at in BCC. Deadline 2026-09-19.
click to expand
GDPR Art. 32(1)GDPR Art. 32(1)(a)GDPR Art. 83(2)(b)+2
Yes
Closed
Disclosure
82d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.