if you are in immediate danger
this page is not where you start. contact crisis support first — then return here for technical proof on synthetic reference data only.
- US suicide & crisis lifeline: 988
- US national DV hotline: 1-800-799-7233
sarah-android — sideloaded accessibility-abuse stalkerware
Synthetic Pixel 7 / Android 14 scenario. Abuser sideloaded Family Locator Pro — renamed, icon-hidden stalkerware with accessibility, notification listener, device admin, and background location exfil. Includes burner-app residue. No real victim. no real victim imagery — ASCII-style device sketch only. see also sarah-mobile-stalkerware for the paired iOS scenario.
what this proves
- all five android stalkerware-sweep primary engines produce deterministic, fixture-locked output — verified by
npm run check:flagship(24/24 fleet · 5 android goldens for this scenario). - every output is generated 100% locally in your browser — no upload, no server-side processing of your evidence.
- sideloaded stalkerware permissions, burner-app residue, and hidden-icon APK abuse surface without uploading a survivor's device.
primary engines locked to this fixture
Synthetic Pixel 7 / Android 14 scenario. Abuser sideloaded Family Locator Pro — renamed, icon-hidden stalkerware with accessibility, notification listener, device admin, and background location exfil. Includes burner-app residue. No real victim.
build the case binder
runs all five primary engines on the synthetic evidence zip and opens a self-contained html binder. no upload.
runs all 8 primary engines locally on the synthetic evidence zip · opens a self-contained html binder · no upload
download the synthetic evidence
MIT-licensed, fully synthetic. no real device screenshots or victim identifiers.
built deterministically from scripts/fixtures/build-sarah-android.mjs. seed: sarah-android:v1.
methodology
android stalkerware hides under benign package names — export the APK and package list first, then walk apk analyzer → permissions auditor → messaging residue → vault apps → clone containers. Family Locator Pro sideloaded with accessibility, notification listener, and device admin on the Pixel 7 fixture is the tell. read the full stalkerware sweep (mobile) guide →
after the playbook
run each primary locally — or export findings from the binder — then drop every csv/json into fatcousin-multi-tool-super-timeline-correlator. one timestamp-sorted timeline across sideloaded Family Locator Pro permissions, burner-app residue, and clone-container abuse — still zero upload.