# Your first audit
Source: https://docs.privacycommand.privacykey.org/first-audit

Drop a bundle in, and what each part of the report is telling you.

Drag a `.app` bundle onto the privacycommand window. A `.dmg` works too — it's
mounted, the app inside is analysed, and it's unmounted afterwards.

Nothing is executed. The whole first pass is [static](https://docs.privacycommand.privacykey.org/static-analysis), so it's
safe on a bundle you have no reason to trust.

## What you get

The report opens on the **Dashboard**, which is the summary view. Four things
are worth reading first.

**Step 1: The risk tier**

A headline judgement with the findings behind it. Expand it — the tier on
its own is far less useful than the signals that produced it.

**Step 2: The telemetry callout**

How many analytics, advertising, and attribution SDKs the bundle ships,
heat-graded, with a per-category breakdown. See [Telemetry](https://docs.privacycommand.privacykey.org/telemetry).

**Step 3: Privacy labels, if it came from the App Store**

The developer's declared Privacy Nutrition Labels sitting next to what the
binary actually contains. See [Privacy labels](https://docs.privacycommand.privacykey.org/privacy-labels).

**Step 4: Background Task Management**

Everything the app registered to start on its own — login items, launch
agents, daemons, helpers. See [Background tasks](https://docs.privacycommand.privacykey.org/background-tasks).

The **Static** tab walks every signal in detail, and every finding carries a
plain-English explanation of what it means. Expand the risk tier and there's a
layer under that again: fourteen of the contributor rows behind the score carry
a **show source** button pointing at the evidence itself — see
[Showing your work](https://docs.privacycommand.privacykey.org/static-analysis#showing-your-work).

## A worked example

Point it at something you already have opinions about — a video-conferencing
app, or anything free that's clearly monetised somehow.

Useful questions to ask of the report:

- **Does the SDK count match the business model?** A paid utility shipping four
  attribution SDKs is worth a second look.
- **Do the hard-coded domains match the vendor?** Third-party hosts in a
  first-party app tell you who else is in the loop.
- **Does the Privacy Manifest match the binary?** privacycommand cross-checks
  these; a gap is more interesting than either side alone.
- **What starts without you?** Login items and launch agents are how an app
  keeps running when you think it isn't.

## Going further

Static analysis has a ceiling: it shows what an app *can* do. To see what it
*does*, launch it under observation with a [monitored run](https://docs.privacycommand.privacykey.org/monitored-runs) —
and if you don't trust it, do that inside [VM mode](https://docs.privacycommand.privacykey.org/vm-mode).