FILE 0001 / REV PUBLICATIONS / STRONGBOX

What Strongbox for iOS sends to RevenueCat and Superwall

Evidence

Twelve runs on three iPhones, 1 to 8 October 2026: the runs, where the data goes, what one first launch sends, the fields of the device profile, the identifiers, the enrich exchange, the paywall resources, the Nudge sequence, the App Store label beside Apple's data types, with its history, and the options of both SDKs; then the method and every published file with its SHA-256.

12 exhibits / Tested 1–8 Oct 2026 / 3 devices / policy 2024-05-09

Capture

DeviceSystemApp buildFromTo
A: iPhone16,1iOS 27.0.11.65.2 (152)
B: iPhone13,2iOS 26.51.65.2 (152)
C: iPhone14,5iOS 26.7.11.65.2 (152)

The runs

Exh. 1 / runs

Twelve runs on four days. Device A had an active annual subscription throughout, and from 3 October Strongbox Pro and Strongbox Zero were also installed on it (authors’ account); on B the entitlement through Family Sharing expired on 3 October; C had never had the app. Cold starts in total: 24 (A 12, B 9, C 3); 6 database unlocks (B: S18 1, T3 3; C: 2). Exact times are omitted: every published file is shifted in time by a constant per run.

RunDateDeviceActivityCold startsCaptureVPN
A01 OctAlaunch, 1.5 min on the home screen1HAR (domain filter), PCAPno
S021 OctA3 cold starts, database locked3HAR (domain filter), PCAPno
S011 OctBfirst launch after installation1HAR, PCAPno
S11b1 OctA6 app openings, including 2 cold starts; crash reporting option off/on2HAR, PCAPno
S173 OctBfresh installation without entitlement, 1 cold start, background/foreground transitions1HAR, PCAPyes
S183 OctBcold start, unlock of a test database, browsing entries, favicons1HAR (domain filter), PCAPyes
T13 OctB5 min, app closed, without Proxyman0PCAPyes
T23 OctB3 cold starts, without Proxyman3PCAPyes
T33 OctB3 cycles: cold start, unlock, 2 entries, lock, background3HAR, PCAPyes
A55 OctA2 × (installation, first launch)2HARyes
A88 OctAinstallation, first launch, 3 starts4HARyes
C88 OctCfirst launch, 2 cold starts, database creation, 2 unlocks; mobile connection3HARno
Exhibit 1 / the twelve runs, 1 to 8 October 2026run codes as in the file names

Where the data goes

Exh. 2 / drawing

What a cold start sends, and to whom. A dashed line marks a recipient that neither the privacy policy nor the support article it links to named in the versions in force at the time of the study (documents of 8 October 2026); a solid line, one they named. The new versions (policy of 15 October 2026, article accessed 16 October 2026) name RevenueCat and Superwall, not Google Fonts or Stripe (report, 3.1). Drawn from all ten published HAR files and the packet capture extracts. Event counts per start are counted from 1 s before to 20 s after app_launch, or to the next app_launch (report, 3.2).

ON YOUR DEVICELEAVES YOUR DEVICECold startevery launchconnection testDuckDuckGoduckduckgo.com, article item 2IDFV in every requestRevenueCatapi.revenuecat.comfirst launch: receipt, token41 to 73 events per startSuperwallcollector.superwall.meconfigurationSuperwallapi.superwall.meprofile; IP location backSuperwallenrichment-api.superwall.comevery start in HARSuperwallsubscriptions-api.superwall.comfirst launch: 127 to 206 requestsPaywall resourcessuperwalleditor, Fonts, StripeCold startevery launchON DEVICELEAVES ITconnection testDuckDuckGoduckduckgo.com, article item 2IDFV in every requestRevenueCatapi.revenuecat.comfirst launch: receipt, token41 to 73 events per startSuperwallcollector.superwall.meconfigurationSuperwallapi.superwall.meprofile; IP location backSuperwallenrichment-api.superwall.comevery start in HARSuperwallsubscriptions-api.superwall.comfirst launch: 127 to 206 requestsPaywall resourcessuperwalleditor, Fonts, Stripe
Exhibit 2 / where data from Strongbox goes on a cold start, 1 to 8 October 2026; disclosure as in the documents of 8 October 2026drawn from Exhibits 3 to 9

Hosts on every cold start

Exh. 3 / table

Which of the five hosts appear in each run. HAR runs show all five on every cold start; in T2, recorded without Proxyman, the names collector and subscriptions-api are not visible. In the 6 captures with DNS answers for these hosts, collector resolves to the addresses of api.superwall.me and subscriptions-api to those of enrichment-api; in T2 the hosts may share one connection (hypothesis, T2 only: in the captures with Proxyman the app opens separate connections to collector; 3.1 of the report). The hosts appear whatever the entitlement.

Rundevice, entitlementStartsSeen inapi.revenuecat.comapi.superwall.mecollector.superwall.meenrichment-api.superwall.comsubscriptions-api.superwall.com
A0A, active1HAR (domain filter)yesyesyesyesyes
S02A, active3HAR (domain filter)yesyesyesyesyes
S11bA, active2HARyesyesyesyesyes
S01B, Family Sharing1HARyesyesyesyesyes
S17B, expired1HARyesyesyesyesyes
S18B, expired1HAR (domain filter)yesyesyesyesyes
T1B, expired0PCAPnonononono
T2B, expired3PCAP (SNI)yesyesnot visibleyesnot visible
T3B, expired3HARyesyesyesyesyes
A5A, active2HARyesyesyesyesyes
A8A, active4HARyesyesyesyesyes
C8C, never bought3HARyesyesyesyesyes
Exhibit 3 / hosts seen per run, with the account state on the deviceHAR and PCAP extracts

The device profile

Exh. 4 / fields

The device_attributes event has 50 to 61 fields (37 events: 59 in 24, 61 in 2, 58 in 2, 51 in 2, 50 in 7). On first launches the events sent before the enrich response have no ip* or demand* fields; 9 events (7 with 50 fields on A5, A8 and C8, 2 with 58 fields on S11b) have no $appTransactionId (hypothesis: sent before the transaction read completed). The groups below name the fields given in the report; the headings are ours. The complete set is in every published HAR file, requests POST /api/v1/events.

Identifiers
$vendorId$deviceId$appTransactionId$vendorId is the IDFV; $deviceId is $SuperwallDevice: followed by the IDFV; $appTransactionId is tied to the Apple account.
Installation
$appInstallDate$daysSinceInstall
Device
$deviceModel$osVersion$interfaceStyle$radioType$isLowPowerModeEnabled$interfaceStyle: dark mode; $radioType: connection type.
Language and place
$deviceLanguageCode$regionCode$deviceCurrencyCode$timezoneOffset
Purchases
$subscriptionStatus$totalPaywallViews
From enrich
$ipCountry$ipCity$ipV4$demandScore$demandTierReturned by Superwall and sent back by the app (Exhibit 8); absent from the events sent before the enrich response on a first launch. The values are replaced with labels or masked.
Exhibit 4 / fields of the device_attributes event sent to Superwall, by kindall 10 HAR files

One first launch, request by request

Exh. 5 / log

The first launch on device C, which had never had the app and never bought anything. The app sends the AdServices token and the App Store receipt to RevenueCat and the device profile to enrich; the events follow in batches. The last batch is the only paywall seen in 24 starts.

# run C8 / device C, iPhone14,5, iOS 26.7.1 / first launch after installation, 8 Oct 2026
# file C8.pub.har / seconds from the first request / paywall resource requests left out
# labels <<TYPE_hash_Llength>> stand for pseudonymised values
+0.000  POST  api.revenuecat.com/v1/subscribers/$RCAnonymousID:<<HEX_9a31ee51_L32>>/adservices_attribution   200
+0.000  GET   api.superwall.me/api/v1/static_config?pk=<<ID_1d5579a4_L24>>                                    200
+0.659  POST  subscriptions-api.superwall.com/subscriptions-api/public/v1/redeem                              200
+0.901  POST  enrichment-api.superwall.com/api/v1/enrich                                                   200
+0.907  GET   api.revenuecat.com/v1/product_entitlement_mapping                                               200
+1.093  GET   api.revenuecat.com/v1/subscribers/$RCAnonymousID:<<HEX_9a31ee51_L32>>/offerings                 200
+1.513  GET   api.revenuecat.com/v1/subscribers/$RCAnonymousID:<<HEX_9a31ee51_L32>>                           200
+1.541  GET   subscriptions-api.superwall.com/subscriptions-api/public/v1/users/$SuperwallDevice:<<UUID_2145e237_L36>>/entitlements?deviceId=%24SuperwallDevice%3A<<UUID_2145e237_L36>>   200
+1.726  POST  api.revenuecat.com/v1/receipts                                                               200
+2.487  GET   api.revenuecat.com/v1/subscribers/$RCAnonymousID:<<HEX_9a31ee51_L32>>                           200
+19.808 POST  collector.superwall.me/api/v1/events   200   6 events
              paywallWebviewLoad_complete, shimmerView_complete (3 times each)
+20.194 POST  collector.superwall.me/api/v1/events   200   50 events
              app_install, app_open, subscriptionStatus_didChange, device_attributes, session_start,
              user_attributes, app_launch, first_seen, redemption_start, enrichment_start,
              redemption_complete, customerInfo_didChange, enrichment_complete, user_attributes,
              config_refresh, device_attributes, config_attributes, trigger_fire,
              paywallPresentationRequest, paywallPreload_start, paywallResponseLoad_start (5),
              paywallResponseLoad_complete (5), paywallProductsLoad_start (5),
              paywallProductsLoad_complete (5), paywallWebviewLoad_start (5), paywallPreload_complete,
              paywallWebviewLoad_complete (2), shimmerView_complete (2)
+21.621 POST  api.superwall.me/api/v1/confirm_assignments                                                     200
+39.801 POST  collector.superwall.me/api/v1/events   200   6 events
              Onboarding, trigger_fire, paywall_open, paywall_page_view, paywall_decline, paywall_close
Exhibit 5 / first launch on device C, 8 October 2026excerpt of C8.pub.har

One value, two services

Exh. 6 / log

The header RevenueCat receives and the fields Superwall receives carry the same label, so the same value. Across the files the two are equal in 9 of 9 files that contain both fields. The source code of both SDKs takes them from the same place. In this batch the first device_attributes event has 50 fields without $appTransactionId, the second 59 fields with it.

# run C8 / device C / first launch, 8 Oct 2026 / file C8.pub.har / seconds from the first request
# the same label is the same value: one pseudonymisation key for all published files
+0.000   POST  api.revenuecat.com/v1/subscribers/…/adservices_attribution
         X-Apple-Device-Identifier: <<UUID_2145e237_L36>>
+0.907   GET   api.revenuecat.com/v1/product_entitlement_mapping
         X-Apple-Device-Identifier: <<UUID_2145e237_L36>>
+20.194  POST  collector.superwall.me/api/v1/events
         event device_attributes, 59 fields, among them:
           "$vendorId":         "<<UUID_2145e237_L36>>"
           "$deviceId":         "$SuperwallDevice:<<UUID_2145e237_L36>>"
           "$appTransactionId": "<<NUM_f9dc87ad_L18>>"
# the same batch holds a first device_attributes event with 50 fields and no $appTransactionId
# D17: Superwall vendorId = UIDevice.identifierForVendor; deviceId = "$SuperwallDevice:" + vendorId
# D18: RevenueCat header X-Apple-Device-Identifier = identifierForVendor
Exhibit 6 / the IDFV in a RevenueCat header and in a Superwall event, device Cexcerpt of C8.pub.har

Exh. 7 / drawing

On device A the IDFV changed between 1 and 5 October and stayed the same between 5 and 8 October (three reinstallations), while Strongbox Pro and Strongbox Zero were installed; $appTransactionId had the same value on 1, 5 and 8 October.

1 Octruns A0, S02, S11bIDFV: value 13 OctStrongbox Pro andZero installed(authors’ account)5 OctA5: installed twiceIDFV: value 28 OctA8: installed againIDFV: value 2$appTransactionId: the same value on 1, 5 and 8 October1 Octruns A0, S02, S11bIDFV: value 13 OctStrongbox Pro andZero installed(authors’ account)5 OctA5: installed twiceIDFV: value 28 OctA8: installed againIDFV: value 2$appTransactionId: the same valueon 1, 5 and 8 October
Exhibit 7 / identifiers sent from device A, 1 to 8 October 2026drawn from S02, S11b, A5, A8

The enrich exchange

Exh. 8 / drawing

On every start the app sends a device profile to enrich; Superwall answers with a location derived from the IP address and a demand score, and the app sends these values back in later events (the demand score and tier also in paywall_open). Field names only: in the published files the values are replaced with labels.

ON YOUR DEVICELEAVES YOUR DEVICEStrongboxevery cold startSuperwallenrichment-api, collectorPOST /api/v1/enricha device profileipCountry, ipRegion, ipCity, ipContinent,ipV4, ipV4ObservedAt,demandScore, demandTierthe same values, in later events:device_attributes, enrichment_complete;demand score and tier also in paywall_openStrongboxevery cold startSuperwallenrichment-api, collectorDEVICESERVICEPOST /api/v1/enricha device profileipCountry, ipRegion, ipCity, ipContinent,ipV4, ipV4ObservedAt,demandScore, demandTierthe same values, in later events:device_attributes, enrichment_complete;demand score and tier also in paywall_open
Exhibit 8 / the enrich exchange on every cold start, field names only20 responses with content in 9 files

Paywall resources

Exh. 9 / counts

On each first launch after installation, the app downloads paywall resources before any paywall is shown: HAR entries to user-content.superwalleditor.com, fonts.gstatic.com, fonts.googleapis.com and js.stripe.com, CONNECT included (C8: the first launch only; its two later CONNECT entries to js.stripe.com are left out). On later starts the HAR holds 0 or 1 such entries. In the packet captures, one short connection to each resource host appears on each start of T2 (without Proxyman), on the single start of S18 and A0, and only on the first start of S02, S11b and T3 (with Proxyman); in T2 a user-content connection received about 5 kB (report, 3.6). In A8 the paywall webview fetches js.stripe.com/clover/stripe.js (1.1 MB); in A5 and C8, at the same time, there are connections to m.stripe.com and m.stripe.network, recorded as CONNECT only, without content, in the authors’ HAR files (not in the published ones).

  1. S01B / 1 Oct163
  2. S17B / 3 Oct198
  3. A5, firstA / 5 Oct206
  4. A5, secondA / 5 Oct176
  5. A8A / 8 Oct127
  6. C8C / 8 Oct160
Exhibit 9 / paywall resource requests on each first launchHAR entries, four hosts

After an unlock

Exh. 10 / drawing

The one observation in which an event followed a database unlock. Run T3, cycle 3, device B, 3 October, about 2 min after the third cold start. In the app’s public code (1.65.0) Nudge is called after a tap on the “Upgrade to Pro” banner on the database list, not by the unlock itself; authors’ account: a tap on the banner in T3 cannot be ruled out.

Cold startthird of threerun T3Unlocktest databaseopenedNudgeapp event; in thecode: banner taptrigger_fire$result =presentRequestconfirm_assignmentsNo displayno paywall_open;the file ends hereNo display event recorded; the user saw no paywall (authors’ account)Cold startthird of threerun T3Unlocktest databaseopenedNudgeapp event; in thecode: banner taptrigger_fire$result =presentRequestconfirm_assignmentsNo displayno paywall_open;the file ends hereNo display event recorded; the usersaw no paywall (authors’ account)
Exhibit 10 / the Nudge sequence after an unlock, device B, 3 October 2026drawn from T3.pub.har

The App Store label and Apple’s data types

Exh. 11 / table

The privacy label lists one data type. Apple’s definitions (D19) name types that match data seen in the traffic; none of them is declared. Whether Apple’s exemptions from disclosure apply beyond the condition quoted in the story, and whether the data are linked to identity on the services’ side, the authors do not decide (report, 3.9). The second table is the history of the label in Wayback Machine snapshots of the US App Store page, read on 16 October 2026; some snapshots do not show the privacy section, so a change is known only to within the interval between two snapshots.

Apple data type (D19)In the label (D13)In the traffic
Purchases: Purchase Historydeclared, “Data Not Linked to You”; subtype and purpose “Analytics” shown in the App Store app on macOS (10 Oct)not compared in the report
Device IDnot declaredthe IDFV to both services on every start (Exhibit 6)
Coarse Locationnot declaredcity and region derived from the IP address, returned by Superwall and sent back by the app (Exhibit 8)
Product Interactionnot declaredlaunch, session and paywall events to Superwall (Exhibits 4 and 5)
SnapshotApp versionLabelBetween snapshots
22 Apr 20251.60.35 (as shown; 1.60.36 was released on 27 Mar 2025)“Data Not Collected”, “The developer does not collect any data from this app.”
4 Sep 20251.61“Data Not Linked to You: Purchases”RevenueCat added in 1.60.39 (12 May 2025)
8 Jan 20261.63.2as on 8 to 10 Oct 2026
5 Mar 20261.64.1as on 8 to 10 Oct 2026Superwall and crash reporting added in 1.64.0 (26 Jan 2026)
3 Sep 2026, 7 Oct 20261.65.2as on 8 to 10 Oct 2026
18 Oct 20261.65.2as on 8 to 10 Oct 2026snapshots of the US and Polish listings (sources/D13_app-store-listing_2026-10-18.pdf, sources/D13-PL_app-store-listing_2026-10-18.pdf)
Exhibit 11 / the App Store privacy label beside Apple's data types and the traffic, and its historyD13 snapshots of 8, 9, 10 and 18 Oct 2026; D19; Wayback Machine

The options of both SDKs

Exh. 12 / table

The options of Superwall-iOS 4.15.3 and purchases-ios 5.21.1 that affect what leaves the device, the value the traffic shows and what the option would change. The full table, with default values and line numbers in the SDK code, is sources/sdk-options_2026-10-10.md. Settings on the services’ dashboards are beyond the reach of this method. Event counts per start: from 1 s before to 20 s after app_launch (report, 3.2).

SDKOption or behaviourKindIn the traffic
SuperwallisExternalDataCollectionEnabledlimiting, partial: would drop trigger_fire, user_attributes and the app’s own events (5 to 10 % of the events)not used: true in 20 of 20 starts
Superwallpaywalls.shouldPreloadlimiting: would remove paywall preloading and about 35 of the 41 to 73 events per startnot used
SuperwallshouldBypassAppTransactionChecklimiting, described in the SDK changelog as “useful in testing environments”: would remove $appTransactionIdnot used
Superwallidentify(), custom user attributes, IDFAexpandingnone enabled
Superwallenrich with location and demand score, device_attributes, IDFV, lifecycle eventsno switch in 4.15.3; a switch covering all events appeared in 4.16.0 (30 June 2026), not covering enrich, which has no switch up to 4.18.0sent on every start
RevenueCatanonymous user, no subscriber attributes, diagnostics offlimiting, the defaultsin effect
RevenueCatAdServices attribution tokenexpanding, off by defaultswitched on by the app: sent on 6 of 6 first launches
RevenueCatone restore and two purchase syncs on first launchexpanding, called by the appon every first launch: 4 receipt posts on A and B (S01: 5), 1 on C, which never bought anything
RevenueCatIDFV header, automatic requests on startno switchevery request, every start
Exhibit 12 / options of both SDKs that change what is sent, as the traffic shows themsources/sdk-options_2026-10-10.md

Technical appendix

Devices, runs, method, documents

A.1 Devices

The three iPhones, the app and the SDK versions are described in the report (How it was studied and What was studied). In addition: B had a fresh installation on 3 October, after the entitlement through Family Sharing (from A) had expired.

A.2 Runs

The run table is Exhibit 1; the totals are in the report (How it was studied). Of the 24 cold starts, 20 have event content in the HAR, 1 is CONNECT only (A0) and 3 are in the packet capture only (T2).

A.3 Tools

The tools, the decryption list and the VPN are described in the report (How it was studied). In addition: the packet captures were taken from the device interface rvi0; m.stripe.com and m.stripe.network were not on the decryption list.

A.4 Pseudonymisation and time shift

The labels, the address labels, the masked CloudFront point of presence and the time shift are described in the report (How it was studied). In addition: the time shift limits the matching of the authors’ records on the services’ side; the vendor knows the test days from the correspondence. The 13-digit sw_cache_key parameter in paywall resource addresses (most likely the publication time of the paywall version on the service side, a hypothesis) cannot be shifted with the run, so it is masked wherever it occurs, with the same placeholder <<MASKED_NUM>> for every value. The content of paywall resources and the entries of other apps were removed. From the packet captures only extracts are published (DNS, SNI, SYN/QUIC, connection statistics), without content. The TLS, DNS and DNS-answer extracts keep only the hosts matching a pattern, the SNI lists (_sni-new.txt) only the hosts named in the report and proxyman.com; the SYN/QUIC extracts (_syn-quic.csv) only the connection starts to the hosts named in the report, and the connection statistics (T2_tcp-conversations.txt) only the conversations with the addresses of those hosts and inside the local network; the rows of other apps were removed. The scripts and their change log are among the files on record (tools/).

The HAR files carry the run codes (data/A0.pub.har … data/C8.pub.har), because the Proxyman export names contained the export time. The packet capture extracts in data/pcap-extracts/ carry the same run codes as the start of their names (A0_… … T3_…; the installation phase before S01: S01-install_…). The runs with extracts, from data/pcap-extracts/README.md:

Run code (extract file prefix) Device HAR of the same run
A0 A A0.pub.har
S02 A S02.pub.har
S01-install (installation phase before S01) B none
S01 B S01.pub.har
S11b A S11b.pub.har
S17 B S17.pub.har
S18 B S18.pub.har
T1 B none
T2 B none
T3 B T3.pub.har

A.5 Documents

D1–D3
Privacy policy, strongboxsafe.com/privacy/, “Last Update: 9 May 2024”, snapshot taken 8 October 2026; the version in force at the time of the study. Text in the policy archive.
D1, new
Privacy policy, “Last Update: 15 October 2026”, accessed 16 October 2026 (sources/D1_privacy-policy_strongboxsafe.com_2026-10-16.pdf and .txt; Wayback: web.archive.org/web/20261016171629/https://strongboxsafe.com/privacy/). Text in the archive.
D4–D8
Support article “What Network Connections Can Strongbox Make?”, snapshot taken 8 October 2026. Text in the archive.
D4–D8, new
The same article, rewritten between 14 and 16 October 2026 according to the authors’ account (on 14 October 2026 still unchanged; checked without a record), accessed 16 October 2026 (sources/D4-D8_network-connections_reamaze_2026-10-16.pdf and .txt; a Wayback Machine capture requested on 16 October 2026 resolves to the archive’s copy of 9 June 2026, the old version, so the record of the new version is the PDF and the text file). Text in the archive.
D9
App Store release notes 1.60.39, 12 May 2025. Text in the archive.
D11
App Store release notes 1.64.0, 26 January 2026. Text in the archive.
D13
App Store privacy label: US storefront, snapshot taken 8 October 2026 (sources/D13_app-store-listing_2026-10-08.pdf); Polish storefront, 9 October 2026 (Wayback Machine: 20261009193211); App Store app on macOS, screenshot taken 10 October 2026 (sources/D13-macAppStore_2026-10-10.png); US and Polish storefronts, 18 October 2026 (sources/D13_app-store-listing_2026-10-18.pdf, sources/D13-PL_app-store-listing_2026-10-18.pdf). History: Wayback Machine snapshots of apps.apple.com/us/app/strongbox-password-manager/id897283731, read on 16 October 2026: 20250422150213, 20250904033117, 20260108191434, 20260305192347, 20260903025419, 20261007214753 (Exhibit 11).
D14
The vendor’s public repository, github.com/strongbox-password-safe/Strongbox: README, snapshot taken 8 October 2026; code at the last commit of 17 July 2026 labelled “1.65.0”, accessed 10 October 2026.
D15
Techlore, “The Password Manager that Took KeePass to the Next Level (Strongbox Interview)”, YouTube lxCR8-YsuHU, published 1 August 2026, segment 32:57–40:56, accessed 9 October 2026. Interviewee: Alex Logan; role as given in the video description, “VP of Engineering at Applause, the company behind Strongbox” (techlore.tech, accessed 9 October 2026). Transcript by the authors from the audio: sources/D15_transcript_32-57_2026-10-09.txt; selected passages: sources/D15_transcript-excerpts_2026-10-09.md. Snapshot of the video page with its description: sources/D15_youtube-description_2026-10-18.pdf (snapshot taken 18 October 2026; it replaces a snapshot of 9 October 2026 with the same description). The vendor’s reply of 14 October 2026 links to 44:26 of the recording; the authors’ transcript of the segment from 43:50 to the end: sources/D15_transcript_43-50_2026-10-14.txt.
D16
Post “Strongbox 1.64.0” on r/strongbox by u/strongbox-support, 26 January 2026, 12:08 UTC, snapshot taken 9 October 2026. Text in the archive.
D19
Apple, “App privacy details on the App Store”, developer.apple.com/app-store/app-privacy-details/, accessed 10, 16 and 17 October 2026.
D20
Superwall, “App Privacy Nutrition Labels”, accessed 9, 10, 16 and 17 October 2026; “Demand Score”, accessed 10 and 17 October 2026. RevenueCat, “Apple App Privacy”, revenuecat.com/docs/platform-resources/apple-platform-resources/apple-app-privacy, accessed 16 and 17 October 2026.
Apple
developer.apple.com/documentation/storekit/apptransaction/apptransactionid, accessed 3, 16 and 17 October 2026.
EP1–EP3, EP6, EP7, EP7a
Sources of the epilogue (the authors’ opinions), accessed 17 October 2026 (descriptions in sources/README.md). EP1–EP3 each as the main text from the raw Wayback Machine capture and as a PDF printed from that capture; EP6 and EP7 as text and as a PDF exported from the replay of the capture on 18 October 2026; EP7a as text only. EP1: Applause, “Strongbox Joins Applause”, 13 March 2025 (Wayback; .txt, .pdf). EP2: Applause, “Let’s Try This Again”, Bartender blog, 10 June 2024 (Wayback; .txt, .pdf). EP3: A. Engst, “Bartender Developer Explains and Apologizes for Quiet Acquisition”, TidBITS, 5 June 2024 (Wayback; .txt, .pdf; article only, without the readers’ comments). EP6: the entries for versions 5.0.52 and 5.0.53 of the Bartender 5 update feed, dates as given by the publisher (Wayback; .txt, .pdf). EP7: release notes of Bartender 5.0.53 (Wayback; .txt, .pdf). EP7a: the release notes of 5.0.52, as archived on 18 May 2024, mention neither Amplitude nor Applause (EP7a; Wayback; .txt).

A.6 SDK source code

Both SDKs at the versions given in the request headers, read on GitHub on 9 and 10 October 2026 (sources/sdk-source-notes_2026-10-09.md, with line numbers and permalinks; sources/sdk-options_2026-10-10.md, the options of both SDKs set against the traffic):

  • D17, Superwall-iOS 4.15.3: Sources/SuperwallKit/Network/Device Helper/DeviceHelper.swift, vendorId from UIDevice.current.identifierForVendor; Sources/SuperwallKit/Dependencies/DependencyContainer.swift, makeDeviceId() returns “$SuperwallDevice:(deviceHelper.vendorId)”.
  • D18, purchases-ios 5.21.1: Sources/Networking/HTTPClient/HTTPClient.swift, header X-Apple-Device-Identifier set from identifierForVendor.
  • D18a, purchases-ios 5.21.1: Sources/Purchasing/Purchases/Attribution.swift, automaticAdServicesAttributionTokenCollection: Bool = false, switched on by enableAdServicesAttributionTokenCollection().

A.7 The archived texts on this site

The policy archive holds the texts of D1, D4–D8, D9, D11 and D16 as plain text, and the new versions of D1 and D4–D8. D1 and D4–D8 of 8 October 2026 were extracted from the PDF snapshots of 8 October 2026: the browser’s page header and footer, the site’s navigation and footer and, for the article, the sidebar of related articles were left out; line breaks are those of the PDF. The Document changes page prints the same two versions from the Wayback Machine snapshots of 1 October 2026: the words are the same, apart from link addresses that the article’s PDF prints and its hyphenation. D9 and D11 are the two entries, unchanged, from sources/D9-D11_appstore-version-history_2026-10-09.txt. D16 is the post text, unchanged, from sources/D16_post-text_2026-10-09.md. The new versions of D1 and D4–D8 are the page texts of 16 October 2026, unchanged, from sources/D1_privacy-policy_strongboxsafe.com_2026-10-16.txt and sources/D4-D8_network-connections_reamaze_2026-10-16.txt. The PDF snapshots themselves are among the files on record.

A.8 Checking the files

Every file below is served byte for byte, as in the authors’ repository; README.md is the short report and FULL-REPORT.md the full report, both in English. data/SHA256SUMS.txt and sources/SHA256SUMS.txt are the authors’ own checksum lists, and data/SHA256SUMS_originals.txt holds the checksums of the unpublished original captures, under the run codes. To check a download: shasum -a 256 -c SHA256SUMS.txt in the folder that holds the list.

Files on record

Files / v1

The report, its change log, the pseudonymised captures, the packet capture extracts, the scripts, the vendor’s documents and the correspondence, as published by the authors. The SHA-256 of each file is computed from the bytes this site serves. Licence: text and data CC BY 4.0, scripts MIT.

139 files, 19,492,695 bytes, served byte for byte at /files/strongbox-ios-network-traffic/v1/

v1/The short report (README.md), the full report (FULL-REPORT.md) and the change log (CHANGELOG.md).

FileBytesSHA-256
CHANGELOG.md33,7369e18be170d7a0f232a56f0ce76b83db356da03cf336c01be3d01778de765a135
FULL-REPORT.md90,4859d950e212d801e665aebe5eeb0bfb4c41346e0cfb017c6baa128f58d061539f0
README.md52,32279d99eef33c1c85b75a875271a08d92705b57e32994bc2a196ba9344c4ea85da

correspondence/The thread with the vendor, 2 to 19 October 2026, ten messages, without addresses.

FileBytesSHA-256
correspondence_2026-10-02_to_2026-10-19.txt24,980f30a897b834991a45b25851f4498ecc80f66f0a9f1955069901b8117d1c08ec7

data/Pseudonymised HAR files per run (*.pub.har), their check reports and checksums.

FileBytesSHA-256
A0.pub.har11,8253eacd482b806b1af172e97a4d15653b355d58eba0b56f9d1f97e5af408fd09de
A0.pub.har.sha25677748c2fa49049b511de220f07d3c590ee20da46afb0e1560820eb7a562c091cc4
A0.pub.report.txt2,458c26ced4ba4a4759b39b2da400a7172d42e7d9986b8474e6fc9d5b41b13853bae
A5.pub.har1,932,3099f62d35583693aa7c202fa4b3c28c010bd1144eb3a34e949974def29231aced2
A5.pub.har.sha25677c6dc27b8ef8ba73aca2c02fc244c6e1d3f0b3befe9d25ee8be8cd760200e5048
A5.pub.report.txt3,4822fd267f7ce2769e047d30ff9691cd816f2fb961b144de9ef2e2fd5a993a7a63e
A8.pub.har992,067641bb104e1ad6ea207872df81ae32322914095bbfd568b0435c44571cfcf1424
A8.pub.har.sha25677f24639ad412016d8db12bffc94e268736b3fa06b69f4aadcb8f0839067d8f1e9
A8.pub.report.txt3,5209edd89ff180ad051f794244a6d45f1fa4e5c0ca8dbfe9cc88a8a18e4970b8fcb
C8.pub.har1,067,90586047a2444c1e9761bba44194fab1553091135d72ee9228ae47816a24db118fd
C8.pub.har.sha25677b28a2abd6861373e9a67888e73e7d60b3769e6955cdcdfabbe4f40cb3fcbc5f8
C8.pub.report.txt3,475709646e4a33ef251e7befad7c2a17c8da5c428d964b6128b45df626b55ac0fe4
S01.pub.har836,6510224309882430b19b0ac79d775c0c9c00ff22ef2f8f6779b64ffc5105ef3302d
S01.pub.har.sha25678825f6c7679b0a09b133b3d4ac528a8ca7eef2be7709f932d6cabfde85403a7be
S01.pub.report.txt3,472d0b3863191aace3b12b209cb6259fc7194ba669cf183d7d9670ee19183a8e11a
S02.pub.har307,5343c6262ccaa97eeeb26e57e02a7fcf57a8068a68b35118865de0ba12d5101c454
S02.pub.har.sha256781c0df585c54fcf295b32669ad540ed47e472edfccb5e0b8ee43816295be5d0a9
S02.pub.report.txt3,020af456034a48c74d4aa00c2e64a800c47a623ade3cdee345e485dc31aded98800
S11b.pub.har296,96780069f3170cf07d5c008f8bf262976b0dbccb2c11ec2f51f916fdcf364dce171
S11b.pub.har.sha25679f411bd2ad1cacb7c9f682cd5b0a555695c58f362ac26dd79a60cdfc615b54ca8
S11b.pub.report.txt3,025d1912b219824f614432d84d0acb64de76a85fdb30205065c802dc741c80654bb
S17.pub.har979,481e6dabdfe240ee146dcd8ade152bebda1482a6b1fb6709fa0a3433f014e28b7f8
S17.pub.har.sha25678ee3ca798d4d00ebebe9ff03faaa75c75f95bfa7915dfcffa265eb0c01f72d3ec
S17.pub.report.txt3,4192a575c4edb265dbba777ee2f0fe7fd81aa39afe56a39a38629ab263a652bad7e
S18.pub.har136,18877a5f2ddaf7975d9397a839914a2e798280d0ad24a262ec7c02389c109a9b248
S18.pub.har.sha25678e6e6109672cd7e5fb9e095bf9d5eb400ea1496ace85a5edd4f6c61f26e539a15
S18.pub.report.txt3,0156a102fa9e5bbef557a77787468f3d0c320b218de56d530cc46f2f309911ab1d5
SHA256SUMS_originals.txt1,927aa9e5e5398ad903134283c9e13c0d302ee0185ad43eb860382df49a45ca75e6f
SHA256SUMS.txt7,66932717e2a8b0a39e823fcb091a8c68abf124fccf0538bd497f4a22a13fe14f176
T3.pub.har356,58512aec72aeeb4af15081c016c746ea0ec409c36f2698139e1ad48b64c452eff54
T3.pub.har.sha2567735cd818cc761d9201fb23e545833009edbefbe28308a1997adb324b0b222d4ac
T3.pub.report.txt3,01704a4a505640b2ca4c58db2f316718972c433f990b9b865f8c176b8f4f5ff2edb

data/pcap-extracts/Packet capture extracts: TLS server names, DNS, connection starts, TCP statistics. No content.

FileBytesSHA-256
A0_dns-answers.csv363f79a03c0a96cbd47002b27f6ef395f0b1b7ba8972a8d052c7aab3dece5f81759
A0_dns.csv287561484073741bfc394a11e159eef4bdb364c004e896593721dd043e86e2c3089
A0_sni-new.txt4383392179acc67bc356d3aeead4c0c18cb2cbc1eb2c058b42a31e97ee516d8b6eb
A0_syn-quic.csv773a49a77941bf1aa3ca3726eb8eee87fd4b50ad02f12103df87aab9f10cce43d02
A0_tls-connections.csv7995d3ace91b1336be06bd4ffd52785247bd65c5158bfb02335cda612209e02b052
README.md4,779526be36defc7223c7c673735c4c5b5cfbff9fa31bbb6890f1521b4ad1734ab84
S01_dns-answers.csv758df6e0de41f46f3690c575591dfc721d546374a9b5af428154535e5108be494fb
S01_dns.csv537bbb3237fd6012a2ba66a8182c830cc8fe166eb62ae8dadd9e3181634267222af
S01_sni-new.txt412fddd47346bcaf63f8b52f62de90408aad0de674647c544c09966267c808757e8
S01_syn-quic.csv2,44451d63efaf600d82683e1d7e7ec7786fabe5def66459934c16f347d466d690519
S01_tls-connections.csv2,095ace7bcd12b2fa7656815bd356bac1ddef4505c576ec2d85dc13c691d3d5dd8d5
S01-install_dns-answers.csv546a9547476092d7b37df466f21df8c3055ce60dc0bbd239fb8115b0057983f447
S01-install_dns.csv50cc2d2d6e5257b67de206aa198763783870669e14bd482b67d465c96c8e1afd51
S01-install_sni-new.txt20639c82588169c7f2fa31b7056cc418b5101c98c69015c8c8b9a0d8646572059a6
S01-install_syn-quic.csv589c84e63a8f6f8c9fba7ab36832da78e400fac46bf175a650d6db7b1e219e1215
S01-install_tls-connections.csv12036754411ff52ca47c2815ac1e07a0211c99258219c858af888535a8a472104e6
S02_dns-answers.csv1,161d11cfe61432d61e880fa26661c27367d6b7b6895722fbf4546121741b0973b3a
S02_dns.csv8006b16d46380fcafb995630a1b386ab03a5a1551845290f6ef8417c6dcaf5c8caa
S02_sni-new.txt4383392179acc67bc356d3aeead4c0c18cb2cbc1eb2c058b42a31e97ee516d8b6eb
S02_syn-quic.csv2,459855b49fb8cffba9c6c2b4a0d57a0ded0518d262b35aedde85ae4394c8d0b5f15
S02_tls-connections.csv2,00063be22b9431814675e656176202f2986f460fb3b623ad620211af03c6c83600d
S11b_dns-answers.csv1,354b28ae8dc3fb1179efcf771b2097a54770ebab9a87984980d0b3fc6fe13c519a8
S11b_dns.csv9350628fb248f1e97ac3cc233652f0c1a7920d955629ea30680c6e143a715ddc098
S11b_sni-new.txt3987a94ce7c678acf9342e719966847ad91d2d9c7d848e61aeb119a120b34e75f46
S11b_syn-quic.csv2,91376a5411bc7823f73b54d2df7909e65b1a8bb330d957e26c4b1173df2f11cd484
S11b_tls-connections.csv2,287493d947058f539d7f3aed99efb28fb28fe97ce61105dfec814d6d6eca7d884d8
S17_dns-answers.csv839275a707fca36811ec03d71243461f47ba34692de657ed92b84269000c24fc696
S17_dns.csv624e31fb76121650bfeb356cecb241798bc0d6b867c2b719d5220367d69b823e000
S17_sni-new.txt439913089245a474705669c3b5744036c666046769095118d9f3673cddc2029f847
S17_syn-quic.csv2,642e49fb5802a9da5b8fb4d73af8d9e968245f9d0f7d1e39360170aaf01a70e6e52
S17_tls-connections.csv2,335a0947c050c379762e5ac2a1ffb22118c4de46f8718d577910a46ad6a2e091a88
S18_dns-answers.csv901023b3d6b2a382ce1f9a1340ea624cb8cb796f7ee65c2dbac3d35403a4ef1ffc0
S18_dns.csv6570977f480f14c87d3c613fdca2d782eb9f9f7d8df233c022c5252a2d586ffd917
S18_sni-new.txt4876c06b3dae9a4688ce2b6776c7bd1b9de90821779e88e3e9e92ed4af605ea52f3
S18_syn-quic.csv1,951285056b631912c64462766853f6ff1c40562471673dfa7645adddaa5b33d44e4
S18_tls-connections.csv1,833b399ce29073fa5f07a5c63607c844736f824c1365bde7e2701adc64178b6ad74
T1_dns-answers.csv546a9547476092d7b37df466f21df8c3055ce60dc0bbd239fb8115b0057983f447
T1_dns.csv50cc2d2d6e5257b67de206aa198763783870669e14bd482b67d465c96c8e1afd51
T1_sni-new.txt2068e907b6d3443bd1054a0f0e3ab3b56bb0650cf3e96b173640254b6a55686a1f8
T1_syn-quic.csv589c84e63a8f6f8c9fba7ab36832da78e400fac46bf175a650d6db7b1e219e1215
T1_tls-connections.csv12036754411ff52ca47c2815ac1e07a0211c99258219c858af888535a8a472104e6
T2_dns-answers.csv546a9547476092d7b37df466f21df8c3055ce60dc0bbd239fb8115b0057983f447
T2_dns.csv50cc2d2d6e5257b67de206aa198763783870669e14bd482b67d465c96c8e1afd51
T2_sni-new.txt342d5fdcb9a533fb4bb0a1fc33d2b14d0320cf2907b7ed50a12473b77180a9943d1
T2_syn-quic.csv2,3064603b3a34850f7f1b388013161c640d5ffc4b4b64756820020a720001b62b160
T2_tcp-conversations.txt4,9240ae2d75c21702854f1d2daa9482288de05199cd46f3d77fcb785a667e96c6e70
T2_tls-connections.csv1,4473d356a9210c01323212b842ab7e736f111f2bcb981eb361a09deb53f1fc9d415
T3_dns-answers.csv1,434454f01498f40cf4a71f03c9f270f26d7242868e361fb1bd5bd213277d8c82f79
T3_dns.csv96897b578cbcafb78062d703524b19e44ced3d2b13eb99a2e8666dc1596e0e05fd9
T3_sni-new.txt397f8819fac5fc25e5a4f057699e27554ae4dc4eebaae37adc2fb62fb3bb22195a5
T3_syn-quic.csv2,5779aeda52aa4342ff5bba1dc3f580d5b3c414fde3ea0625243ccb78afbdeeb1cd2
T3_tls-connections.csv2,074160f03cf9d3bb188294289e65d17bcb8d9d1982724bda9e86cd605daad9b9336

figures/The two drawings of the short report as standalone SVG files: where data goes on a cold start and the enrich exchange, the same as Exhibits 2 and 8.

FileBytesSHA-256
data-flow.svg4,4847cb961bda5b9415b0e2eac15a772567118424162e977c0222805327ed9fdb6c7
enrich-round-trip.svg2,547ab14470e77859075fa7f1dc17064f355985cc7a469514b75e546bf61c1e92edb

sources/Snapshots of the vendor’s documents in the versions of 8 October 2026 and 16 October 2026, the interview transcripts, the SDK code references and the SDK options table, the sources of the epilogue (EP1–EP3, EP6, EP7, EP7a) and the two screenshots of the App Privacy Report (P0).

FileBytesSHA-256
D1_privacy-policy_strongboxsafe.com_2026-10-08.pdf133,914f2a6ab70f7ca4da132bed5c53f925a41752ab6354109ee4ad85366019501b448
D1_privacy-policy_strongboxsafe.com_2026-10-16.pdf121,53930dc6d785f4596934552bcfe2c6b7486b2cb10e53ff0198906ea41675e5a3679
D1_privacy-policy_strongboxsafe.com_2026-10-16.txt5,8274a9b85255cd36d341dc2355cf1b1d522ae3424d4bb8b2fef651737a59ea2d468
D1_privacy-policy_strongboxsafe.com_wayback-20261001190802.pdf126,178a4c5a34c23ba1c540ee26feb81d5e782cb9b175c5c2c0fc2df6a52a62ac5dc74
D1_privacy-policy_strongboxsafe.com_wayback-20261001190802.txt6,0257f90966cb4c01b037894306d5e269b935d5afba8044c80fadba32d8231925a39
D4-D8_network-connections_reamaze_2026-10-08.pdf179,5955b9b738856ff71b44cd4d8abd51a27d1d62c154a2f971dd1801ec5dba6686967
D4-D8_network-connections_reamaze_2026-10-16.pdf57,03480691200c5b31a871ea888ae366b3fa8fdca339d6f4451e848aea08feba54ecd
D4-D8_network-connections_reamaze_2026-10-16.txt4,4592f6e4e0f952e097cb9113aa5df95751d46cffa48b88c055534b2f0f576fb2b5b
D4-D8_network-connections_reamaze_wayback-20260609122910.pdf93,0025e64c0ba37210724a2a1fb05ce0bbcc21179fec2a8572485fd75237b4aa20ddc
D4-D8_network-connections_reamaze_wayback-20261001191012.txt3,137baa4b3365d05d392028cdaedab0213fffc33cbbb8ff7abbdce62f91ace767109
D9-D11_appstore-version-history_2026-10-09.txt21,73463c1e917ed31502bbae63de49ba67644faf1632d473161a0729704aaac6fecc6
D11_appstore-version-history-1.64.0_macAppStore_2026-10-18.png285,625d2a6742e696e3f1b330c3fa6ef0145e75cf4a176eec8e94f3007c68ce530a666
D13_app-store-listing_2026-10-08.pdf820,4686a3d561b51797adcf45633a97ccc1229a5dff9bc734ce7c1bd26c570cec1a9c4
D13_app-store-listing_2026-10-18.pdf779,6495a6ba1a497bc5dd80e1ba52655ca07210e2a79a84596960291229d5fb08b385c
D13-macAppStore_2026-10-10.png90,341bac0538dd8e438ed4bd40f0d7a758c2046d8508362ef933d7d88cb1740c43b2a
D13-PL_app-store-listing_2026-10-18.pdf1,447,11197b8b213dcb33d3626ff0a8c1d770b741ae54ee78037d5345e40f5eba6df4310
D14_github-readme_2026-10-08.pdf238,227e16e14604abcb7e8fd6f1859812177ff381cab9f76cf270520cd1687ab639c17
D14_github-readme_2026-10-18.pdf229,324f3f885bd3617f0bb3cd6c64bc83d3549818e34405ef9377d8d4e787d7d907070
D15_transcript_32-57_2026-10-09.txt8,091076a7ba9e7c35dae23dcd537b8b49055661aceca69c1a1c5f6236ffb735d7583
D15_transcript_43-50_2026-10-14.txt15,7972778bf50c02bebb81c58c3dbc6315b74df5cd3152cecf3c9c906dfa8e22528dc
D15_transcript-excerpts_2026-10-09.md1,9584923aec40ffd248750d466d55d4ebcdc1527a547887e9b4ab70e5af76e6b5651
D15_youtube-description_2026-10-18.pdf4,747,2663e3c2d8a15e854a0e1b719dafe9939427619b879e3513549611965d1614e7622
D16_post-text_2026-10-09.md3,269cddf5807a20550e98f65a74a60af9c2c97d0b3dcadbc25a94dbba382e5be6803
EP1_strongbox-joins-applause_strongboxsafe.com_wayback-20261016232547.pdf525,300bc3111b26a20b3f3d098c648aec19deaaa5a3a0e1e2fa08771f04b9d8df08f26
EP1_strongbox-joins-applause_strongboxsafe.com_wayback-20261016232547.txt4,072634789fe8f23316de035fe0b381558a43f3d0603c54f14ff2656dc352efb7ce2
EP2_lets-try-this-again_macbartender.com_wayback-20261016232701.pdf1,107,608a3ef4497fe207d6723bcd80308571d66ddee765d5e37b28f03dd5af1a801f8be
EP2_lets-try-this-again_macbartender.com_wayback-20261016232701.txt2,891df0734c97943112ceeb99a005aac4e00295393a5108a761b7040ebcabd5ccdbd
EP3_bartender-quiet-acquisition_tidbits.com_wayback-20261016232732.pdf88,88218dbbb88e219c7e86ac84526f159d01fd3ca21baf83619d921bd1cf43afba09a
EP3_bartender-quiet-acquisition_tidbits.com_wayback-20261016232732.txt2,793503c7c0f190a1a69e02de5cb10ec3677c5c8a5d46d85fc32a97f4bd0c633ac96
EP6_bartender-5-update-feed_macbartender.com_wayback-20251116051042.pdf28,595758dcf1c43600a2535de0d5039725ad98e3ce7361d0328886c1406d4b74806a9
EP6_bartender-5-update-feed_macbartender.com_wayback-20251116051042.txt1,184b13ddae46c54ff9ca856b4ab2eec9d669cb4d619bf16fd5242fd6ed288d107ae
EP7_bartender-5.0.53-release-notes_macbartender.com_wayback-20250614191649.pdf25,5635c1dacc524173edcafab012f4b4ed8296f84f2126bb9f1d2b49d1871d11507c2
EP7_bartender-5.0.53-release-notes_macbartender.com_wayback-20250614191649.txt530f1466e87ae0e69d26e4b4c6177d2820b743d3c237ce7e35c607e4c6432b2811c
EP7a_bartender-5.0.52-release-notes_macbartender.com_wayback-20240518170255.txt1,575e3f58b5e8d66648392baadfac38fce7b56ed07bbf61bf0202c859f9f3c53a877
P0_app-privacy-report_domains_2026-09-30.png340,533881580b71b469e546b0c04ff450416622caf66df935500c3ef68da48c2420824
P0_app-privacy-report_most-contacted_2026-09-30.png473,724301f86efdf1462d86e8e6d1f8d851f52e9bc9e8df16e9d1feec30b0e43904b14
README.md21,2986a2fe0852ecdcf405996632a0686293e899cf22643369bf19485b10fa23c410e
sdk-options_2026-10-10.md15,5859f7944418d030b81a1456aae4eb578ac1805b03d4ff1af760d0959e02354a9d6
sdk-source-notes_2026-10-09.md4,80313a147788c04f388fa327a71ae7f4b347e5ca665005204183e42ba692b3cdfce
SHA256SUMS.txt4,5929a48f38d6e7716318bb8f8b4175f4208a7349e979b0dd0659cd80f6a508c354e

tools/Pseudonymisation and analysis scripts, with their change log.

FileBytesSHA-256
CHANGELOG.md34,180ca1b5a279b05021fa3b33715d2913165dc0666f39dc07703e9d778da36b8f48c
clean_metadata.py15,809ce809fa3e2557bd50d65a6b96123054733ac7a57c502faeedbdcfb27df136d10
extract_html_text.py3,430743c9857edd55a83ca452463745c07cc3a2d7d38af643a70bcd5456ad8c9ffe7
extract_pcap.sh8,921740e78d46dcf7720ae972592e7e58ff54e541f64e70b41cb532d296ace2d1159
findings_table.py8,624054f49d4863634ee42be98f475e287d55bcd96e2471318cef0cfa7275cb2d5db
prepare_har_for_publication.py46,555d9cb3abfd955d5a0aeda5eace4511a706fad62e841b879f2fbe5b3f3eb7a4148
pseudonymise_har.py59,658d5795f28a560ee59cfe1a5ace96105f5b78749c343e300ceba4198df4315e3b7
rerun_pipeline.sh2,933457162f246a6ba770f35bb650839cc8fe1f4aaf891c2050b1bd57fda03b369fb
shift_extract_times.py16,4599ea4535c8ed2d69f371acfcbb2bfa22b34385376e16b683c75de6f8e5494dd6b

Back to the report