@appdoor/expo-sdk@1.0.1
Expo SDK for AppDoor - open-source alternative to Branch.io, AppsFlyer OneLink, and Firebase Dynamic Links. Deferred deep linking, attribution, and smart routing.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe package sends first-launch fingerprint data to its own attribution service, a normal feature for Android/web. However, it does so without an iOS platform guard despite documenting iOS attribution as clipboard-based with no fingerprinting, so the excess collection warrants a warning.
Decision evidence
public snapshot- The README says iOS deferred attribution uses a clipboard token “no fingerprinting,” while fingerprint fallback is for Android/web.
- On first launch, reportInstall collects a fingerprint and proceeds to report the install.
- The install request body always includes the collected fingerprint; no iOS guard excludes it.
- The fingerprint includes app and OS details, timezone, language, screen dimensions, device model, device ID, and application ID.
- The package is an attribution SDK, and install reporting is part of its documented feature.
- The install report runs from initialize(config), and repeat launches use cached attribution instead of reporting again.
- The default endpoint is the package’s AppDoor service; no unrelated collector or credential flow was identified.
Source & flagged code
5 flaggedPackage source references dynamic require/import behavior.
dist/referrer/clipboard-token.jsView on unpkg · L17The README says iOS deferred attribution uses a clipboard token “no fingerprinting,” while fingerprint fallback is for Android/web.
README.mdView on unpkg · L10Findings
Affected versions and remediation
This report applies to @appdoor/expo-sdk@1.0.1.
See all versions of @appdoor/expo-sdk for other recorded verdicts.
- Review the evidence and your use of @appdoor/expo-sdk@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.