eBike Flow Security & Privacy Scorecard
Android
Ride data and app usage are shared with Firebase Analytics, Firebase Crashlytics, and Adjust for performance monitoring and install attribution. Mapbox powers the maps, and Google Play Billing handles any in-app purchases. User data flows to these services during normal use.
Best for
eBike riders comfortable with standard analytics
Findings
- 0 critical
- 0 high
- 1 medium
- 2 low
- 3 info
1 issue identified across security and privacy analysis.
Top security issues
- JavaScript Enabled in WebViews with Domain Restrictions
- Deep Link Receiver Forwards Intent Data Without Initial Validation
- Hardcoded Adjust SDK Token (SDK Currently Disabled)
Top privacy issues
- Client-Side API Keys (Mapbox and Google)
- Firebase Configuration Values Exposed
- JavaScript Interfaces with Safe Methods Exposed
Full analysis
eBike Flow
Version: 1.31.5 (1118)
Scan Date: March 5, 2026
Overall Security Score: 99/100 | Privacy Score: 100/100
What This Means for You
Ride data and app usage are shared with Firebase Analytics, Firebase Crashlytics, and Adjust for performance monitoring and install attribution. Mapbox powers the maps, and Google Play Billing handles any in-app purchases. User data flows to these services during normal use.
Recommendation: Very Secure
Best For: eBike riders comfortable with standard analytics
Key Findings
Data Security - 3 findings (1 low, 2 info)
Network Security - 0 findings
Code Safety - 0 findings
Privacy - 0 findings
Privacy Concerns
What Data is Collected
eBike Flow collects ride activity, app usage patterns, and device diagnostics. Performance data and crash reports are sent to Firebase, and Adjust receives install and attribution information to track how the app was discovered.
Third-Party Data Sharing
User data is shared with the following third-party services:
- Firebase Analytics - App usage and behavioral tracking
- Firebase Crashlytics - Crash and stability reporting
- Firebase Performance - App performance monitoring
- Adjust SDK - Install attribution and marketing analytics
- Mapbox - Map rendering and navigation
- Google Play Billing - In-app purchase handling
Understanding the Scores
| Category | Score |
|---|---|
| Security | 99/100 |
| Privacy | 100/100 |
| Data Security | 100/100 |
| Network Security | 100/100 |
| Code Safety | 99/100 |
| Data Collection | 100/100 |
| Data Sharing | 100/100 |
| User Control | 100/100 |
Positive Security Features
- Authentication is handled via AppAuth, an industry-standard OpenID Connect library
- Network communications use modern, well-maintained libraries (OkHttp and Retrofit)
- Local data is managed with Room, Android's recommended structured database layer
- Data collection is scoped to app functionality and standard crash reporting
Areas for Improvement
- Some internal data storage configurations could be refined to further limit what is retained on the device.
- A small number of informational observations were noted around how app data is organized internally, with no direct impact to user privacy or security.
- One minor code safety item was identified that has no effect on everyday use.
About This Analysis
This scorecard is produced by automated static analysis of the app's compiled code and configuration files. Scores reflect the security and privacy practices observed in this version of the app.
App Details
- App Name: eBike Flow
- Package ID: com.bosch.ebike.onebikeapp
- Version: 1.31.5 (1118)
- Scan Date: March 5, 2026
- Platform: canITrustThat
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 100/100 |