Critical Severity
Published: Oct 25, 2026
An analysis on open-source Android apps intended to learn if they are harmed by vulnerable dependencies 🔒
# OSS Android apps and insecure dependencies
An experiment intended to demonstrate the value you can get from [gradle-bodyguard](https://github.com/dotanuki-labs/gradle-bodyguard). Also, a small and independent security study about Android open-source apps, by a curious Software Engineer.
## Goals
In order to share with you why I wrote **gradle-bodyguard**, I chose 13 open-source Android apps - from several players in the industry - and our goal here is figure out if they are eventually consuming **vulnerable dependencies** as part of the Gradle build; or worse than that, if they are **shipping code assured to be vulnerable** to users.
I picked up the following projects as targets of our experiment. All of them build with Gradle without any custom setup :
- [santa-tracker](https://github.com/google/santa-tracker-android), a Christmas game for kids (**Google**)
- [plaid](https://github.com/android/plaid), a showcase for Material Design (**Google**)
- [uamp](https://github.com/android/uamp), a demo for simple universal audio player (**Google**)
- [iosched](https://github.com/google/iosched), the official app for Google I/O conference (**Google**)
- [sunflower](https://github.com/android/sunflower), a showcase for Android Jetpack libraries (**Google**)
- [duckduckgo](https://github.com/duckduckgo/Android), privacy-first search engine (**DuckDuckGo**)
- [signal](https://github.com/signalapp/Signal-Android), a private messenger (**Signal Foundation**)
- [corona-warn-app](https://github.com/corona-warn-app/cwa-app-android), official contact tracer app in Germany (**German government**)
- [immuni-app](https://github.com/immuni-app/immuni-app-android), official contact tracer app in Italy (**Italian government**)
- [freeotp](https://github.com/freeotp/freeotp-android), an open-source 2FA app (**community driven**)
- [haven](https://github.com/guardianproject/haven), an app that helps to protect exposed people, like journalists (**The Guardian Project**)
- [mozilla-l