Topic starter
02/08/2026 11:50 am
TL;DR: No evidence of unauthorized location tracking was found in testing of the White House mobile app, according to NowSecure, showing that static code inspection can overstate risk when it is not validated against runtime behavior. The broader lesson is that high-impact mobile apps need continuous static and dynamic testing, plus tighter scrutiny of third-party SDKs and privacy claims.
Editorial analysis by NHI Mgmt Group, based on content published by NowSecure: “An Expert’s Perspective on the White House App — Putting Security Findings in Context”.
Key questions
Q: How should teams verify whether a mobile app is actually collecting sensitive data?
A: Use both static and dynamic analysis.
Q: Why can static analysis overstate privacy risk in mobile apps?
A: Static analysis shows what code is present, not what the app executes.
Q: What are the signs that a third-party SDK is creating mobile privacy risk?
A: Look for enabled data collection, unexpected network calls, excessive permissions, and features that activate only after configuration changes or user consent.
Practitioner guidance
- Run static and dynamic testing together Use static analysis to find embedded code and dynamic testing to confirm what the app actually transmits or activates on real devices.
- Review every third-party SDK as part of the attack surface Inventory notification, analytics, messaging, and similar components, then verify whether each dependency is enabled, collecting data, or relying on remote services.
- Validate privacy claims against observed behaviour Compare app store disclosures, internal privacy statements, and runtime network traces so claims about location or other sensitive data match actual flows.
Bottom line: Static analysis can reveal embedded capabilities, but it cannot prove that a mobile app is using them in practice.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:59 pm
Static analysis creates a capability illusion: code inspection is valuable for finding what a mobile app could do, but it routinely overstates risk when teams treat dormant features as active behaviour. The White House app coverage shows how quickly a permission flag or SDK capability can be mistaken for actual data collection. For practitioners, the governance problem is not code visibility itself, but the false certainty that comes from stopping there.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations rely on app store review to catch mobile app security issues?
A: No. App store review is a baseline gate, not a full runtime assurance process. It can miss third-party SDK activity, data flows that only appear on real devices, and configuration-dependent behaviour. Organisations with high-impact apps need independent testing to validate both security controls and privacy claims.
👉 Read our full editorial: White House app testing shows why static analysis alone misleads