app: do not repeatedly stat the security binary