#Ford #AppLink is a pretty cool protocol, even though it's officially discontinued.
Turns out, there's nothing stopping you from spoofing an arbitrary "App ID" meaning you can get the permissions of the old version of the FordPass app.
This includes making arbitrary OBD-II/UDS queries and getting live location data.
Not really a user security issue, per se, since the user still has to approve turning on AppLink and allowing access to vehicle data... but still interesting.
https://github.com/BlueOvalLabs/pyapplink