CITT

    Scan results

    American Airlines

    Android

    American Airlines official app for mobile boarding passes, flight tracking, seat selection, baggage tracking, and loyalty account management. Features real-time flight updates, interactive terminal maps, Admirals Club access, and account information.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Frequent flyers comfortable with behavioral analytics

    Not For: You prefer travel activity not session-recorded

    What It Means For You

    In-app behavior, including flight searches and booking activity, is captured by session-recording tools from QuantumMetric and Celebrus. Interactions are also shared with Adobe Experience Cloud, Google Analytics, and Firebase for marketing and behavioral tracking. Users have limited ability to opt out of this data collection within the app.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (14)

    Data Security

    3 total
    1 Critical
    1 High
    1 Medium

    Network Security

    2 total
    2 High

    Code Security

    5 total
    1 Critical
    4 Medium

    Privacy

    4 total
    1 Critical
    2 High
    1 Medium

    Third-Party Services

    QuantumMetric, Adobe Experience Cloud, Celebrus, Firebase Analytics, Google Analytics, Airship, ASAPP Chat, LocusLabs, Akamai Bot Manager, PairIP, BouncyCastle

    Security Strengths

    • ✓PairIP tamper protection with signature verification
    • ✓Modern AndroidX libraries (Room 2.6.1, OkHttp 4.12.0 with CVE patches)
    • ✓Google ML Kit on-device OCR (passport/card data not uploaded to cloud)
    • ✓EncryptedPkceStore demonstrates proper use of AndroidX Security Crypto
    • ✓No SQL injection vulnerabilities (Room ORM with parameterized queries)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    travel
    financial
    location
    sensitive data
    loyalty program
    payment
    biometric documents
    session recording
    cross platform tracking

    Package

    com.aa.android

    Version

    2026.2

    Analysis Date

    Feb 12, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 critical, 1 high, 1 medium)

    Network Security - 2 findings (2 high)

    Code Safety - 0 findings

    Privacy - 4 findings (1 critical, 2 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    American Airlines collects behavioral data across user sessions, including flight searches, booking interactions, and browsing patterns. This data may be linked to the user's account and device across multiple sessions.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • QuantumMetric - Session recording and behavioral analytics
    • Adobe Experience Cloud - Marketing and behavioral tracking
    • Celebrus - Session recording and digital analytics
    • Firebase Analytics - App usage and performance tracking
    • Google Analytics - Behavioral analytics
    • Airship - Push notifications and in-app messaging
    • ASAPP Chat - In-app customer support chat
    • LocusLabs - Airport mapping and indoor navigation
    • Akamai Bot Manager - Traffic filtering and access control
    • PairIP - Application integrity checks
    • BouncyCastle - Cryptographic library

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy35/100
    Data Security40/100
    Network Security75/100
    Code Safety70/100
    Data Collection50/100
    Data Sharing55/100
    User Control40/100

    Positive Security Features

    No notable positive security features were identified in this version.

    Areas for Improvement

    • Travel activity and in-app behavior is shared with multiple advertising and analytics platforms, with very limited controls available to reduce this sharing.
    • Session recording tools capture detailed logs of how users interact with the app, including search patterns and navigation through the booking flow.
    • The app provides minimal in-app options to opt out of behavioral data collection or limit how data is used for marketing purposes.

    About This Analysis

    This scorecard reflects the security and privacy posture of the American Airlines Android app at the time of analysis. Findings are based on static analysis of the application package.

    App Details

    • App Name: American Airlines
    • Package ID: com.aa.android
    • Version: 2026.2
    • Platform: Android
    • Scan Date: February 12, 2026

    Right of Reply

    Developer not yet contacted