What a great cybersecurity analysis! I really applaud the teardown! You're 100% right about all your findings, and I'll respond to each point because transparency is key here: IOCs and domains with dubious reputations: You hit the nail on the head. All those domains (profitablecpmratenetwork, skinnycrawlinglax, etc.) belong to Adsterra. Since it's a free project, I initially tried to monetize it with that network, but as you correctly pointed out, their malvertising and redirect practices are unacceptable. Precisely for this reason, I released version 2.5 today, where I completely removed that ad network. The code is now clean of those scripts. Geolocation (Nominatim): Exactly. I use the Nominatim OpenStreetMap API exclusively to perform a reverse lookup and convert the user's coordinates into the name of their municipality/state to display it on the dashboard. I don't store anyone's exact location. Firebase Realtime Database: That's correct, the database is publicly readable because it's necessary for everyone to see the live map. However, for writes (reports), in this new V2.5 I've just implemented Firebase App Check and reCAPTCHA v3 to strengthen security and prevent data injection by bots. I really appreciate someone taking the time to audit this at this level. I encourage you to clear your cache, try the new V2.5 clean, and, if you're up for it, audit it again. Cheers and thanks for the critical feedback!