Scan results

Recommendation: Significant Security Concerns

Critical cryptographic flaws — hardcoded encryption keys enable decryption of all push notifications, and the unencrypted message database is silently backed up to Google Drive. These issues directly conflict with TeleGuard's stated privacy and zero-knowledge guarantees, making it unsuitable for sensitive communications.

Key Findings

High Security Risks (2 issues)

1. Push Notification Encryption Is Universally Broken ❗
   TeleGuard uses the same encryption key — embedded directly in the app — for every user worldwide. Because anyone can download the app and extract this key, anyone can decrypt the content of push notifications sent to any TeleGuard user.

   At Risk:

   • Message preview content shown in notifications
   • Incoming call alerts and identifiers
   • Any information delivered via push notifications

2. Download Security Checks Disabled App-Wide ❗
   A component responsible for file downloads disables standard connection security verification for the entire app. This means that on a network where an attacker can intercept traffic, files downloaded through the app may be tampered with or replaced.

   At Risk:

   • Files and media downloaded within the app
   • Any content fetched over an insecure or compromised network

   This applies if: You use the app's download features on public or untrusted WiFi networks.

   For most users: On your home or work network, exploitation is unlikely.

Medium Security Risks (3 issues)

1. Message Database Backed Up to Google Drive Unencrypted ⚠️
   Android's automatic backup feature is not disabled, meaning your message database is silently uploaded to your Google Drive account. The database itself is not encrypted, so anyone who accesses your Google account can potentially read your message history.

   Note: This applies to all users by default. You can reduce this risk by disabling auto-backup for TeleGuard in your Android device settings.

2. Message History Not Protected on Device ⚠️
   The database storing your messages is not encrypted. On a rooted device — or if someone gains physical access — your full message history, contact associations, and session data could be read directly.

   Note: This vulnerability requires either a rooted device or direct physical device access. Users with standard, unmodified devices are not affected under normal conditions.

3. Deep Link Handling Accepts Unverified Input ⚠️
   The app can be triggered by other installed apps via notification links without verifying the source. Input values are passed into the app's processing pipeline without sanitization. The practical impact for users depends on how the app's core logic handles such input.

Low Priority Items (4 issues)

1. Inconsistent File Sharing Permissions
   The app's file-sharing configuration is overly broad, potentially allowing the app to share files from locations beyond what is necessary for messaging. This does not directly expose data but increases the potential impact of other vulnerabilities.

2. Notification Preferences Stored Without Additional Protection
   App configuration data including notification settings is stored in a standard format that could be read on a rooted device.

3. Legacy Storage Mode Enabled for Older Android Versions
   On Android 10 devices, downloaded files may be written to a location accessible by other apps. This has no effect on Android 11 and newer.

4. Decryption Failures Are Silently Ignored
   If the push notification decryption process encounters an error, the failure is not logged or reported. This makes it difficult to detect if something goes wrong or if the app is being actively attacked.

Privacy Concerns

What Data is Collected

• Account information: TeleGuard ID (anonymous number — no phone number or email required)
• Messages: Message content (processed for delivery)
• Media: Photos and videos shared within the app
• Device information: Standard device data required for push notifications
• Contacts: If you grant permission, the app can read and modify your contacts

Third-Party Data Sharing

The following third parties may receive your data:

• Google Firebase — Push notification delivery only (Firebase Analytics and advertising tracking are explicitly disabled)
• Google Play Billing — In-app purchase processing

No advertising, analytics, or user tracking third parties were identified in this analysis.

Understanding the Scores

Security: 61/100
Privacy: 85/100

Security Breakdown

• Data Security: 55/100 — Message database is unencrypted and backed up to Google Drive; push notification encryption is fundamentally broken
• Network Security: 74/100 — Network security configuration is generally sound, but file download component bypasses connection verification
• Code Safety: 92/100 — App code is well-structured with no significant code-level vulnerabilities

Privacy Breakdown

• Data Collection: 98/100 — Minimal data collection; no advertising IDs or analytics
• Data Sharing: 100/100 — No data shared with advertising or analytics third parties
• User Control: 90/100 — Strong anonymity model; no account registration required

Positive Security Features

• ✓ Firebase Analytics and advertising tracking are explicitly disabled in the app
• ✓ No advertising, tracking, or analytics SDKs present in the app
• ✓ No phone number or email required to create an account — strong anonymity model
• ✓ App links use verified domain association, preventing other apps from hijacking TeleGuard links
• ✓ Voice and video calls use standard DTLS-SRTP media encryption
• ✓ Firebase usage is strictly limited to push notification delivery — no broader data collection

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Disable Automatic Cloud Backup
   Explicitly opt out of Android's auto-backup feature to prevent unencrypted message data from being uploaded to Google Drive without user knowledge or consent.

2. Transparent Data Handling Disclosure
   Update the app's data safety declaration to accurately reflect automatic backup behavior and local storage practices.

Security Enhancements

1. Encrypt the Local Message Database
   Protect stored messages with device-level encryption so that message history is not accessible even if the device is compromised.

2. Use Per-Installation, Per-Message Encryption Keys
   Replace the shared global encryption key and static nonces with keys and values that are unique to each installation and each message.

3. Scope File Download Security Controls
   Apply security verification only to the download component rather than disabling it app-wide.

Technical Context

App Type: Encrypted Messenger (Privacy-Focused, Sensitive Communications)
Classes Analyzed: 5,574
Third-Party Services: 10
Context Tags: Communication, Sensitive Data, Camera, Contacts, Encrypted Messaging

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Swisscows AG
Version: 4.0.9 (versionCode 175)
Analysis Date: April 3, 2026
Package: ch.swisscows.messenger.teleguardapp

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 4.0.9 analyzed on April 3, 2026
• May not reflect server-side security controls
• Cannot detect all runtime behaviors

For questions about this analysis, contact [email protected].