CITT

    Scan results

    Alaska Hawaiian

    Android

    Travel light at each stage of your journey with Alaska Airlines' companion mobile app. Book flights using rewards points, check in up to 24 hours before departure, add boarding passes to Apple Wallet, and receive real-time flight updates. Manage reservations, purchase seat upgrades, and track family

    CITT SCORE
    58
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Alaska flyers comfortable with standard analytics

    What It Means For You

    Booking activity, travel patterns, and in-app behavior are shared with analytics and marketing services including Adobe Analytics, Firebase, Tealium, and Quantum Metric. Identity verification data passes through Jumio when ID-based features are used. User data stored on the device, including payment and loyalty account details, may not be fully protected.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (17)

    Data Security

    5 total
    2 Critical
    2 Medium
    1 Low

    Network Security

    4 total
    1 Critical
    1 High
    2 Medium

    Code Security

    5 total
    1 Critical
    3 High
    1 Medium

    Privacy

    2 total
    2 Medium

    Third-Party Risk

    1 total
    1 High

    Third-Party Services

    Adobe Analytics, Firebase Analytics, Tealium, Quantum Metric, Auth0, Urban Airship, Jumio, Optimizely, OkHttp, Retrofit, Ktor Client

    Security Strengths

    • ✓Certificate pinning implemented for *.alaskaair.com
    • ✓Modern MVVM architecture with dependency injection
    • ✓Latest SDK versions (OkHttp 4.12.0, Firebase 2024 releases)
    • ✓Proper file access restrictions in WebViews
    • ✓Parameterized SQL queries preventing injection
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    camera
    travel
    authentication
    payment

    Package

    com.alaskaairlines.android

    Version

    7.6.9 (Build 330)

    Analysis Date

    Feb 12, 2026

    Classes Analyzed

    1,868

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 5 findings (2 critical, 2 medium, 1 low)

    Network Security - 4 findings (1 critical, 1 high, 2 medium)

    Code Safety - 0 findings

    Privacy - 2 findings (2 medium)

    Privacy Concerns

    What Data is Collected

    Alaska Airlines collects travel booking details, loyalty account information, location data, device identifiers, and behavioral data about how users navigate and use the app, including searches, interactions with offers, and notification engagement.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Adobe Analytics - Behavioral analytics and marketing measurement
    • Firebase Analytics - App usage tracking and crash reporting
    • Tealium - Data management and audience segmentation
    • Quantum Metric - Session replay and user experience analytics
    • Auth0 - Authentication services
    • Urban Airship - Push notification delivery
    • Jumio - Identity document verification
    • Optimizely - A/B testing and feature experimentation

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy72/100
    Data Security35/100
    Network Security40/100
    Code Safety50/100
    Data Collection75/100
    Data Sharing78/100
    User Control70/100

    Positive Security Features

    • None identified in this version.

    Areas for Improvement

    • Sensitive data stored on the device, including payment and loyalty account details, may not be fully protected against access by other apps or by someone with physical access to the phone.
    • Data sent between the app and its servers in certain situations travels with less protection than expected.
    • With behavioral data flowing to multiple analytics providers, clearer in-app controls would give users more choice over what is collected and shared.

    About This Analysis

    This scorecard is generated through automated static analysis of the app's code and configuration. Scores reflect practices observed at the time of the scan and may change as the app is updated.

    App Details

    • App Name: Alaska Airlines - Travel
    • Package ID: com.alaskaairlines.android
    • Version: 7.6.9 (Build 330)
    • Scan Date: 2026-02-12
    • Platform: Android

    Right of Reply

    Developer not yet contacted