I'd treat it as an indicator, not a certainty. All of stef's rules are indicators, where any one could be raised without the application being a problem. The more that get raised, the more likely the app is snake oil.

It's like personnel security -- an employee gambling is not necessarily a problem, but it can indicate a potential security risk. And it's like diagnosing medical or psychiatric conditions -- a lack of empathy for other humans might not mean anything, but it's an indicator for psychopathy.

Regarding the security app indicators, good job, stef. And I'll add one: "10000000000-bit encryption!!!!"