A Deep Peek at DeepSeek

SecurityScorecard/STRIKE analyzed DeepSeek Android (v1.0.8) and found hardcoded keys, weak crypto (e.g., DES), SQL injection and other CWE-classified weaknesses, extensive user and telemetry collection (including keystroke patterns) stored in China, anti-debugging measures, and embedded ByteDance telemetry libraries; although no explicit malicious behavior was observed, these issues present high privacy and national-security risks and warrant remediation and further investigation.