Finding and Verifying Mobile Apps

1. Ask: "May I research iOS and Android apps for the target company and its verified companies and brands?" — wait for yes, unless the user already authorized this stage or the full investigation.
2. Pull verified names/domains from earlier stages. If missing, request them or limit scope to identity checks needed for app research.
3. Search both stores with name variants, brand names, acquired-company names, publisher names, and @domain email patterns.
4. Open every candidate listing and verify developer, legal entity, copyright, website, privacy policy, support contact, and email domain against the verified register.
5. Run the mandatory second pass with different terms — always, even if pass one found nothing.
6. Report a short verified table, note what the recheck covered, and ask permission to proceed to GitHub research.

Progress:

• Step 1: Ask permission to research apps
• Step 2: Prepare search inputs (names, brands, domains, email patterns)
• Step 3: Run first discovery pass (iOS + Android)
• Step 4: Verify each candidate app against the register
• Step 5: Run mandatory omission recheck with alternate terms
• Step 6: Resolve any newly discovered entities as leads
• Step 7: Report table, note recheck coverage, ask permission for GitHub stage

Step 1 — Ask Permission

Ask exactly: "May I research iOS and Android apps for the target company and its verified companies and brands?"

Skip only if the user has already authorized this stage or the entire multi-stage investigation. Do not proceed silently otherwise.

Step 2 — Prepare Search Inputs

Gather from prior stages:

• Legal entity name(s) and trading/former names
• Verified acquisitions, subsidiaries, owned brands
• Verified domains
• Known developer/publisher names (if any surfaced earlier)

Build email-domain search patterns by prefixing each verified domain with @:

• example.com → @example.com

If the verified entity list is missing or incomplete, ask for it, or narrow this stage to only the identity checks strictly needed to search apps (e.g., confirm the primary legal name and domain).

Step 3 — First Discovery Pass

For iOS, search combinations such as:

• site:apps.apple.com "[Company Name]"
• site:apps.apple.com "[Legal Entity]"
• site:apps.apple.com "[Brand]"
• site:apps.apple.com "[Acquired Company]"

For Android, search combinations such as:

• site:play.google.com "[Company Name]"
• site:play.google.com "[Legal Entity]"
• site:play.google.com "[Brand]"
• site:play.google.com "[Acquired Company]"

Also search using @domain patterns as clues (e.g., "@microsoft.com" near app support pages), and search developer/seller names directly on each platform to pull their entire portfolio — not just title matches. An app can belong to the company even when its name doesn't match. Open individual listings and follow developer, support, website, and privacy-policy links from each.

Step 4 — Verify Each App

For every candidate, check and record:

iOS: developer/seller name, copyright owner, developer website, privacy-policy domain, support domain, legal entity, current listing status.

Android: developer name, linked website, privacy-policy domain, developer email, company address, package/app ID where useful, current listing status.

Cross-check all of the above against the verified company and domain register from earlier stages. Treat an @domain email match as a clue, not proof.

Before including any app, ask:

• Is the publisher genuinely connected to the target or a verified holding?
• Could this be an unrelated company with the same or similar name?
• Is the app current (not delisted, abandoned, or clearly outdated)?
• Does an official company site link to it?
• Could it belong to a former, sold, licensed, partner, or parent-owned sister business?
• If a third party publishes an "official" branded app, is there authoritative evidence of the target's control or endorsement — or just naming similarity?

Resolve conflicts using current primary sources. Keep unresolved candidates out of the verified table.

Step 5 — Mandatory Omission Recheck

Always run this pass, even if Step 3 found zero apps.

Repeat searches using:

• Alternate/former brand names
• Acquired-company names not yet tried
• Publisher names surfaced during verification
• Additional verified domains and their @domain patterns
• Full portfolio review of every verified publisher found so far
• Links followed from official company websites (app download badges, footer links, press pages)

Look specifically for apps missed in the first pass. Verify every new addition to the same standard as Step 4. Remove duplicates, unrelated apps, and outdated/delisted listings from the combined set.

Step 6 — Handle Newly Discovered Entities

If an app listing reveals a company or brand not in the earlier verified register:

• Treat it as a lead, not a fact.
• Verify its current relationship to the target before attributing the app to it.
• If confirmed, update earlier findings and search this new entity within the current app stage (Steps 3–5).
• If the discovery points to unrelated asset categories (e.g., a GitHub org, a domain not yet verified), queue it for the appropriate later stage — do not chase it now.

Step 7 — Report and Pause

Produce a table:

Platform | App | Publisher | Asset/brand | Direct app link | Source

Rules:

• Include only verified, current apps.
• 1–2 short, clickable evidence links per row (store listing, official site confirmation).
• Deduplicate iOS/Android pairs by app identity but preserve separate platform links (one row per platform).
• If nothing verifies, state "None verified" — never "the company has no apps."

Then state briefly what the recheck covered (which alternate terms/portfolios were searched) and whether it added anything.

Finally ask: "May I proceed to GitHub research?"

Do not begin GitHub research without explicit permission, unless the user already authorized the full workflow. Retain the verified names, domains, and @domain patterns — they carry forward into the GitHub stage.

Example 1: Input: Client: Microsoft Corporation; primary domain: microsoft.com. User approves app research. Output:

• Pass 1: site:apps.apple.com "Microsoft Corporation" finds Microsoft Authenticator (iOS), developer listed as Microsoft Corporation. @microsoft.com used as a search clue alongside official app page check.
• Pass 2 (mandatory): site:play.google.com "Microsoft" + portfolio review finds Microsoft Authenticator (Android), publisher verified against official Microsoft page.

Recheck note: Second pass added the Android listing missed in pass one. @microsoft.com retained for GitHub stage. Final line: "May I proceed to GitHub research?"

Example 2: Input: Small target company with no obvious branded apps. Output: First pass finds nothing under the legal name. Mandatory recheck with acquired-brand names and @domain clues still finds nothing. Table: "None verified." Recheck note: Confirms alternate brand names and domain-based searches were tried; no additions. Final line: "May I proceed to GitHub research?"