[scarface74]

How do you “catch” them? The ID is sent from the app and not in plaintext.

[tgsovlerkhgsel]

Through the usual software analysis methods (reverse engineering, static and dynamic analysis, ...)

[afiori]

I imagine with the usual review process

[scarface74]

The review process can’t tell the contents of the data being sent back.