CITT

    Scan results

    Apple Wallet

    iOS

    Apple's built-in Wallet app for storing and managing digital passes including boarding passes, loyalty cards, event tickets, and payment information. No third-party services or tracking.

    CITT SCORE
    98
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Users managing passes, tickets, and cards on iPhone

    What It Means For You

    No third-party analytics, advertising, or data-sharing services are embedded. Pass and card data is handled entirely through Apple's own OS-level frameworks, with no external companies receiving user information. All network activity requires encrypted connections.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (9)

    Data Security

    2 total
    1 Low
    1 Info

    Network Security

    2 total
    2 Info

    Code Security

    2 total
    2 Info

    Privacy

    3 total
    3 Info

    Security Strengths

    • ✓No third-party SDKs or analytics services embedded
    • ✓Default ATS enforced — all connections require HTTPS/TLS 1.2+
    • ✓Secure state restoration variants implemented (shouldSaveSecureApplicationState)
    • ✓No WebView or JavaScript bridge — zero JS attack surface
    • ✓No custom URL schemes or universal links — no external invocation attack surface
    • ✓All sensitive payment/credential operations handled by OS-level Secure Enclave frameworks
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data

    Package

    com.apple.Passbook

    Version

    6.6 (Build 1)

    Analysis Date

    Apr 17, 2026

    Classes Analyzed

    21

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on App Store

    Recommendation: Secure Official App

    Apple's official Wallet with no third-party trackers or SDKs. Excellent security practices. Safe for all users. Only minor: missing data protection class entitlement.

    Key Findings

    Data Security - 2 findings (1 low, 1 info)

    Network Security - 2 findings (2 info)

    Code Safety - 2 findings (2 info)

    Privacy - 3 findings (3 info)

    Privacy Concerns

    What Data is Collected

    • Pass and ticket data: boarding passes, loyalty cards, event tickets
    • Payment card information (managed by Apple Pay / Secure Enclave)
    • Device information required for pass syncing via iCloud

    Third-Party Data Sharing

    No third-party data sharing was identified in this analysis.

    Understanding the Scores

    Security: 97/100
    Privacy: 100/100

    Security Breakdown

    • Data Security: 94/100 - Strong protection overall; sandbox files default to a slightly lower protection class without an explicit data protection entitlement
    • Network Security: 100/100 - All connections require HTTPS/TLS 1.2 or higher by default; no cleartext exceptions configured
    • Code Safety: 100/100 - No web rendering surface, no JavaScript bridge, and all external data ingestion delegates to Apple OS frameworks

    Privacy Breakdown

    • Data Collection: 100/100 - No analytics, advertising, or behavioral tracking libraries present
    • Data Sharing: 100/100 - Zero external network destinations detected; no data sent to third parties
    • User Control: 100/100 - No tracking or profiling mechanisms found

    Positive Security Features

    • No third-party SDKs, analytics services, or advertising libraries embedded
    • All network connections require HTTPS with TLS 1.2 or higher - no cleartext exceptions
    • Secure state restoration correctly implemented using the modern protected variants
    • No web content rendering surface and no JavaScript-to-native bridge
    • No custom URL schemes or universal links - cannot be invoked by malicious external apps
    • All sensitive payment and card operations handled by Apple's OS-level Secure Enclave frameworks

    Areas for Improvement

    GDPR / CCPA Compliance

    The app's privacy practices could be strengthened by:

    1. Explicit File Protection Class Declaration
      Adding an explicit data protection entitlement would ensure all sandbox files are locked when the device screen is locked, rather than remaining accessible after the first unlock since boot.

    Security Enhancements

    1. Data Protection Class Upgrade
      Declaring the highest file protection class in the app entitlements would provide an additional layer of defense for any pass data written to the local sandbox, particularly relevant for users storing sensitive financial or identity passes.

    Technical Context

    App Type: Financial / digital wallet - high sensitivity
    Classes Analyzed: 21
    Third-Party Services: 0
    Context Tags: financial, sensitive_data

    About This Analysis

    This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

    App Details

    Developer: Apple Inc.
    Version: 6.6 (Build 1)
    Analysis Date: 2026-04-17
    Package: com.apple.Passbook

    Analysis Limitations

    • Static analysis only (code review without running the app)
    • Based on IPA version 6.6 (Build 1) analyzed on 2026-04-17
    • May not reflect server-side security controls
    • Cannot detect all runtime behaviors

    Right of Reply

    Developer not yet contacted