I built AppXpose after realizing that Google’s Data Safety labels, the things supposed to tell you what an app collects, are entirely self-reported.
Four peer-reviewed studies later confirmed what I suspected: there’s a massive gap between what apps claim and what they actually do.
So I built a scanner that looks inside the APK directly.
Some highlights from the data:
• Instagram: 68/100 HIGH risk
• Most “free” apps embed 5-15 tracker SDKs you’ve never heard of
• Signing certificates that don’t match what they should
• Apps flagged in MalwareBazaar that are still live on the Play Store
The tracker detection runs fully on-device. Nothing gets uploaded. ~140 SDK signatures, growing via community discovery.
2,000+ installs, 4.6⭐ so far. Still early.
Happy to answer questions about what I found or how the scanner works.
Website for all infos -> https://appxpose.app
App dowloandlink -> https://play.google.com/store/apps/details?id=com.appxpose.app