01 / ORIGIN
Where the file came from
Release artifacts, package identity, hashes, and upstream distribution paths recorded with source links.
ANDROID APP PROVENANCE / INDEPENDENT RESEARCH
Evidence before conclusions.
App Origin Lab is building a source-backed record of Android app origins, signing identities, permissions, and privacy behavior.
THE EVIDENCE MODEL
Four checks behind every published finding
02 / SIGNING
Whether updates share an identity
Certificate fingerprints and signing continuity compared across developer, GitHub, and repository builds.
03 / BEHAVIOR
What the build can actually do
Manifest permissions, embedded components, and version changes separated from unverified assumptions.
04 / METHOD
How each conclusion was reached
Reproducible methods, dated evidence, limitations, and corrections published alongside the findings.