CITT

    Scan results

    myGov

    Android

    Official Australian Government myGov app for secure access to government services. Manage myGov Inbox messages, access 19+ services (tax, welfare, healthcare), store digital cards and certificates in the digital wallet, and sign in with biometrics or PIN.

    CITT SCORE
    58
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Australians managing government services online

    Not For: Users frequently on public Wi-Fi

    What It Means For You

    Usage data is shared with Google Analytics, Firebase Analytics, and Adobe Experience Cloud. Activity on public Wi-Fi networks may be sent without full protection. Users retain strong control over their account data within the app.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    4 total
    1 Critical
    2 High
    1 Medium

    Network Security

    2 total
    2 Critical

    Code Security

    6 total
    1 Critical
    1 High
    4 Medium

    Privacy

    3 total
    1 High
    2 Medium

    Third-Party Services

    Adobe Experience Cloud, Firebase Analytics, Google Analytics, Firebase Cloud Messaging, Google ML Kit, SQLCipher, Pairip, RootBeer, Nimbus JOSE+JWT, OpenID AppAuth

    Security Strengths

    • ✓SQLCipher encrypted database (AES-256)
    • ✓Multi-layer tamper protection (Pairip + RootBeer + integrity checks)
    • ✓Modern authentication (OAuth 2.0/OIDC, passkey/WebAuthn support)
    • ✓Backup protection disabled
    • ✓On-device ML processing (no cloud upload)
    • ✓Government audit logging
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    health
    sensitive data
    government
    welfare
    tax
    analytics

    Package

    au.gov.mygov.mygovapp

    Version

    1.35.0

    Analysis Date

    Feb 2, 2026

    Classes Analyzed

    24,136

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (1 critical, 2 high, 1 medium)

    Network Security - 2 findings (2 critical)

    Code Safety - 0 findings

    Privacy - 3 findings (1 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    The app collects usage and behavioral data including how users navigate government services, session activity, and device identifiers. This information is used for analytics, performance monitoring, and service improvement.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Google Analytics - Tracks how users interact with the app for usage analysis
    • Firebase Analytics - Monitors app engagement and records in-app events
    • Adobe Experience Cloud - Measures user experience for marketing and service analytics
    • Firebase Cloud Messaging - Delivers push notifications to users' devices

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy72/100
    Data Security50/100
    Network Security40/100
    Code Safety45/100
    Data Collection75/100
    Data Sharing75/100
    User Control85/100

    Positive Security Features

    • The app uses an encrypted local database (SQLCipher) to protect data stored on the device.
    • Device integrity checks are in place to help detect if the app is running in a compromised environment.
    • Standards-based secure authentication (OpenID AppAuth) is used for government account login.
    • Secure session handling libraries are in place to protect active login sessions.

    Areas for Improvement

    • Network communications should use stronger protections to keep government data private when the app is accessed on public or shared Wi-Fi networks.
    • Usage data is shared with multiple third-party analytics platforms, meaning several companies outside of government receive information about how users interact with the app.
    • Some data storage practices could be strengthened to better protect personal information saved locally on the device.

    About This Analysis

    This report was generated by automated security analysis of the app's code and behaviour at the time of the scan. Scores and findings reflect the state of the app as of the scan date and may change with future app updates.

    App Details

    FieldValue
    App NamemyGov
    Package IDau.gov.mygov.mygovapp
    Version1.35.0
    Scan Date2026-02-02

    Right of Reply

    Developer not yet contacted