Abstract

Mobile applications leak sensitive data through channels that are not part of their declared functionality, among them default telemetry, diagnostic contexts, logs, insecure local stores, inter process links, the clipboard and network side channels. These flows are termed implicit leakage channels and are studied here for React Native (RN), where the JavaScript layer is poorly covered by existing tooling and where a large language model (LLM) is now often used for development. A test application, FinNotes, is built with 25 deliberately planted channels mapped to the Confidentiality, Integrity and Availability (CIA) triad, and two LLMs from the Claude family (Sonnet 5 and Opus 5) are asked to implement six ordinary feature requests. Across 12 generation runs the models produced 27 provisionally identified additional channels under the current rubric based labelling; insecure local persistence (category C4) dominated for both models. The 17 Sonnet 5 channels were merged into the canonical application, producing a 42 channel benchmark. The paper then defines a static dynamic control method whose static phase combines pattern rules with an LLM dataflow pass and whose dynamic phase instruments the running data layer. On the provisional 42 channel benchmark the static method returns a finding for every labelled channel, and instrumented execution independently confirms 23 of them with measured payloads and no false positives, whereas Semgrep, njsscan and osv scanner in their default configuration detect none. A reusable LLM guided security review skill then fully closes 38 of the 42 channels through four input and output facades; of the remaining four, two are partially mitigated, one is retained as a declared dependency, and one platform specific closure remains pending. The changes cut the summed confidentiality impact by 93 percent with no functional regression and no newly introduced channel. The same LLM is therefore both a source of implicit channels and, when it is constrained by an explicit taxonomy and a facade architecture, an effective means of removing them.

References

• Lampson, B. W. (1973). A note on the confinement problem. Communications of the ACM, 16(10), 613 615.
• Pearce, H., Ahmad, B., Tan, B., Dolan Gavitt, B., & Karri, R. (2022). Asleep at the keyboard? Assessing the security of GitHub Copilot's code contributions. In 2022 IEEE Symposium on Security and Privacy (pp. 754 768). IEEE.
• Perry, N., Srivastava, M., Kumar, D., & Boneh, D. (2023). Do users write more insecure code with AI assistants? In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (pp. 2785 2799). ACM.
• National Computer Security Center. (1993). A guide to understanding covert channel analysis of trusted systems (NCSC TG 030). NCSC.
• Zander, S., Armitage, G., & Branch, P. (2007). A survey of covert channels and countermeasures in computer network protocols. IEEE Communications Surveys & Tutorials, 9(3), 44 57.
• Enck, W., Gilbert, P., Chun, B.-G., Cox, L. P., Jung, J., McDaniel, P., & Sheth, A. N. (2010). TaintDroid: An information flow tracking system for realtime privacy monitoring on smartphones. In Proceedings of the 9th USENIX Symposium on Operating Systems Design and Implementation (pp. 393 407). USENIX.
• Arzt, S., Rasthofer, S., Fritz, C., Bodden, E., Bartel, A., Klein, J., Le Traon, Y., Octeau, D., & McDaniel, P. (2014). FlowDroid: Precise context, flow, field, object sensitive and lifecycle aware taint analysis for Android apps. In Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation (pp. 259 269). ACM.
• Rasthofer, S., Arzt, S., & Bodden, E. (2014). A machine learning approach for classifying and categorizing Android sources and sinks. In Proceedings of the 2014 Network and Distributed System Security Symposium. Internet Society.
• Reardon, J., Feal, Á., Wijesekera, P., Elazari Bar On, A., Vallina Rodriguez, N., & Egelman, S. (2019). 50 ways to leak your data: An exploration of apps' circumvention of the Android permissions system. In Proceedings of the 28th USENIX Security Symposium (pp. 603 620). USENIX.
• Sandoval, G., Pearce, H., Nys, T., Karri, R., Garg, S., & Dolan Gavitt, B. (2023). Lost at C: A user study on the security implications of large language model code assistants. In 32nd USENIX Security Symposium (pp. 2205 2222). USENIX.
• Khoury, R., Avila, A. R., Brunelle, J., & Camara, B. M. (2023). How secure is code generated by ChatGPT? In 2023 IEEE International Conference on Systems, Man, and Cybernetics (pp. 2445 2451). IEEE.
• Fischer, F., Böttinger, K., Xiao, H., Stransky, C., Acar, Y., Backes, M., & Fahl, S. (2017). Stack Overflow considered harmful? The impact of copy&paste on Android application security. In 2017 IEEE Symposium on Security and Privacy (pp. 121 136). IEEE.
• Zhou, X., Cao, S., Sun, X., & Lo, D. (2025). Large language model for vulnerability detection and repair: Literature review and the road ahead. ACM Transactions on Software Engineering and Methodology, 34(5), Article 145, 1 31. https://doi.org/10.1145/3708522.
• Martin, R. C. (2017). Clean architecture: A craftsman's guide to software structure and design. Prentice Hall.
• Reyes, I., Wijesekera, P., Reardon, J., Elazari Bar On, A., Razaghpanah, A., Vallina Rodriguez, N., & Egelman, S. (2018). "Won't somebody think of the children?" Examining COPPA compliance at scale. Proceedings on Privacy Enhancing Technologies, 2018(3), 63 83.