Methodology
The same rules, whoever the client is
An investigator who bends the rules for a paying client isn't an investigator anymore - just a vendor with a fancier vocabulary. These four principles govern where we look, how we test, what we do with what we find, and when it becomes public, regardless of who's paying.
Sources
We only work from what we're lawfully entitled to see: publicly accessible information, devices we own or are authorized to test, and software we're authorized to analyze. If material crosses into unauthorized access to a system we don't control, we don't use it - we report it to the relevant authority instead, the same way we'd want to be treated in reverse.
Methods
Investigate first, judge second: we trace root cause instead of stopping at the first symptom, and every step has to be reproducible by someone other than the person who ran it the first time. A finding that only one person can reproduce isn't a finding yet.
Handling results
Severity gets ranked, not asserted - and every client, paying or not, gets the same triage discipline (ISO/IEC 30111: reproduce it, scope it, fix it, credit the reporter). What changes between tiers is how much of the report stays private and how fast we move - never whether the finding publishes, never the rigor of the underlying work.
Disclosure
A fixed public heads-up window applies before anything goes on the public ledger, giving the organization real time to fix a problem before anyone else sees it. Regulators are told in parallel where our own rules require it, without exposing detail that would put a client at risk before they've had the chance to fix it.
A claim you can't trace back isn't evidence
Most reports stop at a severity label: critical, high, medium. That tells you how worried to be, but not why - and a client's own legal or engineering team can't check work they can't see the steps of. So every finding we deliver is required to answer five questions in order, not just the last one: what did we find, what proves it, how did we prove it, how sure are we, and what should you do about it.
Real, disclosed finding. From "Merge Chicken" (com.Merge.o98Chickens), reported to Google Play & Android Security 2026-06-25, removed from the Play Store 2026-06-30. Full report (PDF)
Finding
A Google Play app rated PEGI 3 ("suitable for all ages") and listed as a casual merge puzzle game functioned as an unlicensed, no-KYC real-money online casino - not present on the face of the submitted build.
Evidence
The gambling UI and logic were absent from the reviewed binary and gated behind a server-controlled switch (Firebase Remote Config), with the live payload served from separately-controlled infrastructure after install.
Method
Static root-level analysis of the published release APK: apktool decompilation, dex/string inspection, manifest review, plus open-source corroboration of the developer entity. No production servers or user accounts were probed.
Confidence
Confirmed - reported directly to Google Play & Android Security as abuse, not negotiated as a vendor disclosure. Google's own security team confirmed removal from the Play Store.
Recommendation
Reported 2026-06-25; app removed from the Play Store 2026-06-30 - 5 days to resolution, the first publicly documented enforcement outcome of the RFI-IRFOS 2026 Android audit programme.
