Notifications
Clear all
Topic starter
02/08/2026 11:50 am
TL;DR: No evidence of unauthorized location tracking was found in testing of the White House mobile app, according to NowSecure, showing that static code inspection can overstate risk when it is not validated against runtime behavior. The broader lesson is that high-impact mobile apps need continuous static and dynamic testing, plus tighter scrutiny of third-party SDKs and privacy claims.
NHIMG editorial — based on content published by NowSecure: White House app analysis focused on static versus dynamic mobile testing
Questions worth separating out
Q: How should teams verify whether a mobile app is actually collecting sensitive data?
A: Use both static and dynamic analysis.
Q: Why do third-party SDKs create mobile security risk even when features are disabled?
A: SDKs expand the app’s potential capability set and can change behaviour across versions or configurations.
Q: What do mobile teams get wrong about app store review and platform controls?
A: They often assume baseline store checks are enough to validate real security or privacy behavior.
Practitioner guidance
- Require dynamic validation before privacy claims are published Compare static findings with real-device network traces and confirm whether sensitive capabilities are enabled, invoked, and transmitting data.
- Inventory SDK capabilities, not just SDK names Document which third-party libraries are present, which optional features are switched on, and which data paths those features can open.
- Separate requested, granted, and exercised permissions Track whether an app requests a protected permission, whether the user grants it, and whether the app actually exercises that access in runtime testing.
What's in the full article
NowSecure's full analysis covers the operational detail this post intentionally leaves for the source:
- Side-by-side static and dynamic test observations from the White House app analysis
- Runtime evidence that location data was not collected or transmitted on real devices
- Discussion of how OneSignal and similar SDKs can carry optional capabilities without those features being enabled
- Practical guidance on how high-impact apps should handle SDK review and mobile testing
👉 Read NowSecure's analysis of the White House app's static and dynamic testing results →
Static vs dynamic mobile testing: what appSec teams need to verify?
Explore further
02/08/2026 12:59 pm
Static findings are not security findings until runtime validates them. The core governance error in this case is confusing capability with behaviour. That mistake is common in mobile security reporting and leads to overstatement or underreaction depending on what the code suggests. For AppSec teams, the lesson is to build evidence thresholds that require dynamic confirmation before privacy or exposure claims are accepted.
A question worth separating out:
Q: How can security teams reduce false positives in mobile app risk reporting?
A: Require evidence from real-device testing before escalating claims about tracking, data collection, or covert functionality. Use clear criteria for when code presence becomes active risk, and separate speculative findings from observed behaviour. That keeps reporting accurate and avoids damaging trust with users, developers, and public stakeholders.
👉 Read our full editorial: White House app testing shows why static analysis alone misleads
