आर्य महासंघ Security & Privacy Scorecard
Android
Location data is looked up via an external service (ipapi.co) and map data is loaded from third-party CDNs, meaning the user's IP and location are shared outside the app. Crash reports are sent to Sentry, and account data is stored on Supabase cloud servers. Several findings suggest stored user information may not be fully protected.
Best for
Members comfortable with basic cloud-connected community
Findings
- 3 critical
- 4 high
- 3 medium
- 1 low
- 1 info
0 issues identified across security and privacy analysis.
Top security issues
- Unencrypted Storage of JWT Authentication Tokens
- JavaScript Bridge Remote Code Execution Vector
- Backup Enabled for Sensitive Authentication Data
Top privacy issues
- Sentry Session Replay Captures PII Without Consent
- Public Storage Bucket Allows Image Enumeration
- No Screenshot Protection (FLAG_SECURE)
Full analysis
आर्य महासंघ
What This Means for You
Location data is looked up via an external service (ipapi.co) and map data is loaded from third-party CDNs, meaning the user's IP and location are shared outside the app. Crash reports are sent to Sentry, and account data is stored on Supabase cloud servers. Several findings suggest stored user information may not be fully protected.
Recommendation: Use With Caution
Best For: Members comfortable with basic cloud-connected community
Key Findings
Data Security - 2 findings (2 critical)
Network Security - 1 finding (1 high)
Code Safety - 0 findings
Privacy - 4 findings (2 high, 1 medium, 1 low)
Privacy Concerns
What Data is Collected
The user's IP address and approximate location are collected each time the app's map features are used. Account details provided by users are stored on Supabase cloud servers. When the app encounters a problem, diagnostic information about the device and session is transmitted to Sentry for crash reporting.
Third-Party Data Sharing
The user's IP address and derived location are sent to ipapi.co automatically each time the app performs a location lookup. Map tiles and geographic data are fetched from OpenStreetMap Nominatim and unpkg.com CDN servers, which also receive the user's IP address as part of those requests. Google Play Services receives standard usage signals as part of Android platform integration.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 45/100 |
| Data Security | 25/100 |
| Network Security | 80/100 |
| Code Safety | 40/100 |
| Data Collection | 60/100 |
| Data Sharing | 55/100 |
| User Control | 70/100 |
Positive Security Features
- Network communications are handled using standard secure transport protocols, resulting in a relatively strong network security score.
- Basic user account controls are present, giving users some ability to manage their own data within the app.
Areas for Improvement
- The app's protection of stored account data may not be sufficient, meaning user personal information may not be fully protected from unauthorized access.
- User location and IP address are shared with multiple outside services, with limited disclosure or controls available to users.
- The app's internal data handling could be substantially strengthened to better protect information processed on the device.
About This Analysis
Independent automated analysis of the app's code and data-handling practices. Results reflect this specific app version and may not capture changes introduced in later releases.
App Details
- App: आर्य महासंघ
- Package: com.aryamahasangh
- Version: 1.0.18 (Build 10018)
- Scan Date: 2026-02-02
- Developer: (not listed)
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 40/100 |