Code from the FBI’s Anom encrypted messaging app
> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists.<p>Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats.<p>Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted content. This is also taking place in other client apps as well: VPN, password managers, extensions, wallets, even build systems and more. Many like VPNs have logs sent elsewhere but deleted locally -- access to entire machine and all network access. People are way too trusting of "secure" systems/apps that are very common today based on trust.<p>All of these apps/systems would pass code checks, reviews, security inspections and essentially be encrypted/"secure" though a copy is sent off to another area for review. At runtime the leak is in the direction of the data.