@t12392n said in App security (new KeepassRX app):
I wish there was an strict firewall native in Ubuntu Touch so that we would see and control what is allowed to talk. A local Keepass should not talk to the internet.
If the app is confined (as this one is) you don't need to blindly trust that the package in the open store was compiled by the code that is linked, to be sure it doesn't phone home. If you know what to look for, you can download the .click package and examine the contents. The most important is the .apparmor file, which describes what permissions the packages requests from the system.

Here we see that this app is indeed confined, and it only declares the content_exchange policy group. This means that the app will not be able to access the network at all, because the networking policy group is not included in the apparmor.