Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
47 15 left unknown, 5 not applicable
Completeness
76% the share the model could weigh
Citations
64 across 12 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 42 hereC weighs 0.70 · 22 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Which identifier the apps hold. The identifier is the largest hole. The policy says the provider assigns a unique identifier to the device and uses it to establish the connection, which is what C12 records as app_scoped_id; the Play data-safety form separately declares that Device or other IDs are shared with other companies, and neither document says which identifier that is. An advertising ID named in either would move C12 two rungs.
Mandate countries, and where the hardware is. C09b is unanswered and matters: six of the eighty offered countries carry a retention mandate and nothing says whether the hardware is there or the location is virtual.
What has no document. C02, C03, C06, C07b and C08 have no document behind them at all - the site describes features, not infrastructure. U06, U08, U12a and U12b are unfilled because the pages that name them are feature marketing rather than statements of coverage, and U08 in particular is a heading that says "all your devices" above a list of platforms that includes a browser extension.
On the record as a whole.
The heavy values here rest on one document: Mixon-Baca, Knockel and Crandall, "Hidden Links: Analyzing Secret Families of VPN Apps", FOCI 2025 (14 August 2025), read in full. It groups Innovative Connecting, Autumn Breeze and Lemon Clove as one family of eight apps with nearly identical decompiled Java, shared libraries and assets, and confirms they share server infrastructure by connecting to each other's servers with the same hard-coded Shadowsocks credentials.
That is the basis for M15, M17 and M18 - not shared ownership on paper, but tunnels established between the brands. X01 is the paper's own finding, corroborating VPN Pro and the Tech Transparency Project: the providers went to lengths to hide that they are owned by a Chinese national, and the detail "is not apparent when viewing the Google Play Store pages of any of these VPNs, nor is it on any website.
the rest of what is open — 494 more words
Instead, these apps state they are Singapore-based." The paper's Figure 1 shows a USPTO copyright filing giving Innovative Connecting a Tongzhou District, Beijing holder address. M11 and C11 follow from that.
X02 is the second finding and the heavier one: "The apps' privacy policies all claim they do not collect user addresses (personal or business), yet we observed them to do so" - the app requests the zip code of the user's public IP from ip-api.com even without location permission and uploads it to a Firebase endpoint. Denied in the policy, observed in traffic.
C01 is filled from the policy and not from the paper, because C01 is the declaration. The policy says no traffic or personal data is stored in the data centres and that usage data is irreversibly anonymised, but the same document declares connection outcome, the location connected to, the user's country and ISP, and a persistent per-device identifier used at connection time, with no session-scoped deletion window.
That is session metadata on the provider's own words. U07 is short and deliberately so. The site advertises "IKEv2 & OpenVPN"; the paper found the settings menu's OpenVPN radio button was not selectable at the time of analysis, so it is not an offer.
The apps also ship Shadowsocks, and U07 now carries it: the vocabulary had no code for it when this record was written, which is why the list read ikev2 alone. C13 accordingly derives shadowsocks - a real, interoperable transport graded with the ones that work and do not carry the guarantees of a modern tunnel, since it has no forward secrecy and authenticates the server with nothing but a symmetric key.
What the vocabulary still cannot express is the paper's central finding: that key is hard-coded and shared across the family, so anyone who downloads the app can decrypt every client's traffic. That is a fact about this implementation and not about the protocol, and no protocol code should be made to carry it; it is priced through X01 and the integrity channel and recorded here.
IntegrityHas it been caught saying one thing and doing another?16 fields read · 2 not applicable · 90.0 points of pressure×0.100
What this channel priced on this record:Lie 0.85Monetisation 0.15Absolute claims 0.04Cluster contagion 0.4Incident handling 0.2Owner transparency 0.4Report concealment 0.15Owner group history 0.35
Transparency reportalso read by ignorance, silenceP05_transparency_report
none
Computed
×0.010 of a clean record completeness 76%
Where the drop comes from: Integrity. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.100, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Ignorance — ×0.784 where the register averages ×0.662 — and furthest below on Integrity, ×0.100 against ×0.658.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
