Apps that move money attract scrutiny, and they should. During 2026 the Empoorio commerce apps went through a security review that found real problems. This post lists them, because a payments platform that hides its fixes is asking users to trust it blind.
Found and fixed
A backend admin key in an app repository. In August 2026 a review of Empoorio Manager found a Firebase Admin service-account key committed to the repository. Such a key grants full backend access. It was revoked, and the functionality that had used it was replaced with server-side Cloud Functions that authenticate the caller — the app now asks the backend to do privileged things and never holds the credential itself.
Keystore passwords readable by everyone. The signing configuration for Android release builds (key.properties) stores keystore passwords in plain text. On 30 August the files were found with mode 644 — readable by any user on the build machine — in 10 of 12 apps. Tightened to 600.
One service key reaching eleven apps. The Play Console upload credential created in July 2026 turned out to have access to eleven-plus real apps, not the five it was thought to cover. Documented; scope reduction planned.
Brand impersonation and seed exposure in SkoopoS App. The August review of the ads app closed two issues: UI that could be used to impersonate third-party brands, and a path by which a wallet seed could be lost. 56 of 56 tests pass after the fix.
Permissions re-injected by plugins. Removing a permission from an Android manifest is not enough — build plugins merge their own manifests and re-add it. The fix is tools:node="remove" in the manifest and verification on the built bundle, not the source. This is now the rule for every app.
Release builds without --dart-define silently shipped in demo mode against localhost, and the binary does not reveal it because both dev and prod endpoints are compiled in. Release scripts now fail if the defines are absent.
Hosts and infrastructure
The ecosystem's servers were not spared. A cryptominer was found and removed from one server in July 2026 (its hash is kept to detect a return); a rootkit was found active on another in September. The incident-response playbook in the chain repository — stop, rotate, move funds, preserve logs, redeploy clean — exists because these happened.
Still open
- Store listings for Eats, Manager and Riders pointed at a support page and contact address that did not resolve; being corrected.
- Updates to the four Gnoosis-published apps are blocked until Google Play's health and financial-feature declarations are filed.
- The Warehouse app's API developer console shows a preview key that no backend has ever issued — decorative, and marked for removal.
Why publish this
Because the alternative — a page listing security audits by firms that never performed them — is what this site used to have. A real list of real problems, with dates and fixes, is worth more to a merchant than a logo wall.
Based on the 4-apps security fixes (2026-08-14), the keystore permissions audit (2026-08-30), the Play Console key audit, the SkoopoS App audit (2026-08-22) and the server incident records.