An SDK needs a full review when it handles personal data, makes its own network calls, loads or runs code at runtime, requests sensitive permissions, or sits in a critical path such as login or payments. Pure UI or formatting helpers can take a fast check.
The four questions that set the tier
Ask these in triage, in this order.
- Does it collect, read or transmit user data or device identifiers?
- Does it talk to the network on its own, outside the calls you write?
- Does it download, update or execute code after install?
- Does it need permissions or entitlements, such as location, contacts, camera or background modes?
One yes puts the SDK in the high tier. Two or more yeses, plus a position in authentication or payments, means the full review is not optional.
A tier table
| Tier | Typical traits | Review depth | Re-review |
|---|---|---|---|
| High | Personal data, own network calls, runtime code, sensitive permissions, auth or payments | Full: code and traffic review, privacy mapping, transitive dependencies | Each major version and every quarter |
| Medium | Network calls to a fixed documented host, limited identifiers, no runtime code | Standard: advisories, maintainer health, traffic check | Each major version and twice a year |
| Low | Local only, no data, no permissions, small footprint | Fast: licence, advisories, maintenance signal | Yearly or on major version |
Examples by trait, not by vendor: analytics and advertising kits are usually high, a push notification library is high or medium depending on identifiers, an image loading helper that makes network requests is medium, a layout or animation helper is often low.
Why transitive dependencies change the tier
An SDK that looks low may pull in a networking stack or a data library. Apple notes that SDKs which repackage listed SDKs are included in its requirement as well. Read the dependency tree before settling the tier, and let the highest tier among the SDK and its dependencies win. Our guide on listing every dependency in an iOS app and the Android equivalent show how.
What a fast check includes
Even the low tier is not unreviewed. The fast check is five lines: licence is acceptable, no open advisories for the version, last release is recent enough to expect fixes, size is reasonable, and the transitive tree is small. Record the result in the register.
Moving an SDK between tiers
Tiers are not permanent. A vendor can add a feature that starts collecting data. An update can add a network call. Treat each major upgrade as a prompt to rerun the four questions. If the answers changed, so does the tier.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how separating reachable code from unreachable code changes what needs attention. The same idea helps tiering: focus review effort where the SDK actually acts in your app.
Safeguard offers dependency scanning and reachability analysis, which help you see what an SDK pulls in and which parts your app actually calls. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Is an open source SDK automatically low risk?
No. Source availability helps review, but data handling, network calls and maintenance matter more than licence type.
Who sets the tier?
The security champion in triage, with the requester's answers to the four questions as input.
Sources
Last reviewed: 19 October 2026.
