Post #963527

https://blog.thereallo.dev/blog/decompiling-the-white-house-app The official White House Android app: 1. Injects JavaScript into every website you open through its in-app browser. 2. Has a full GPS tracking pipeline that polls every 4.5 minutes in foreground and 9.5 minutes in background, . 3. Loads JavaScript from a random person's GitHub Pages site for YouTube embeds. 4. Loads third-party JavaScript from Elfsight (elfsightcdn.com/platform.js) with no sandboxing. 5. Sends email addresses to Mailchimp, images are served from Uploadcare, and a Truth Social embed is hardcoded with static CDN URLs. 6. Has no certificate pinning. Standard Android trust management. 7. Ships with dev artifacts in production. 8. Profiles users extensively. Is any of this illegal? Probably not. Is it what you'd expect from an official government app? Probably not either.