Biomarkers Bryan Johnson Security & Privacy Scorecard
by Blueprint Bryan Johnson · iOS
Usage patterns and in-app behavior are sent to Mixpanel and Segment, two analytics companies. Health and activity data stays reasonably protected, but multiple third-party services receive information about how the app is used.
Best for
Tracking personal health and biomarker data
Avoid if
You prefer apps that collect minimal analytics data
Findings
- 0 critical
- 1 high
- 7 medium
- 5 low
- 10 info
1 issue identified across security and privacy analysis.
Top security issues
- Expo OTA Updates Execute JavaScript Without Code Signing Verification — compromised EAS pipeline could push malicious JS to all users simultaneously
- WKWebView JavaScript Bridge Exposed in Production Telehealth POC Component — JS-to-native bridge with JS-only URL validation
- AWS Cognito Identity Pool ID Hardcoded in Production JS Bundle — enables targeted Cognito API calls and potential unauthenticated credential requests
Top privacy issues
- Privacy Manifest Materially Misrepresents Data Collection — App Store label shows 'No data collected' while Mixpanel and Segment actively collect health-context behavioral data
- Analytics Track Health-Context Behavioral Events Without Confirmed Consent Gating — Mixpanel fires at launch before consent, tracking lab appointment and medical navigation behavior
- Mixpanel A/B Testing Enrolls Health App Users in Undisclosed Behavioral Experiments — experiment assignment transmitted to commercial analytics without disclosure
Full analysis
What This Means for You
Usage patterns and in-app behavior are sent to Mixpanel and Segment, two analytics companies. Health and activity data stays reasonably protected, but multiple third-party services receive information about how the app is used.
Recommendation: Use With Caution
Best For: Tracking personal health and biomarker data
Avoid If: You prefer apps that collect minimal analytics data
Key Findings
Data Security - 4 findings (2 medium, 1 low, 1 info)
Network Security - 6 findings (1 medium, 1 low, 4 info)
Code Safety - 0 findings
Privacy - 5 findings (1 high, 2 medium, 1 low, 1 info)
Privacy Concerns
What Data is Collected
Health and biomarker readings are the core data this app stores. Beyond that, in-app behavior, session activity, and usage patterns are collected for analytics purposes. Device identifiers and interaction events are transmitted to multiple third-party platforms each time the app is used.
Third-Party Data Sharing
Usage data is shared with the following third-party services:
- Mixpanel - Behavioral analytics and event tracking
- Segment - Data routing and customer data aggregation
- LaunchDarkly - Feature flag management (receives device and session context)
- Avo Inspector - Analytics quality monitoring
- AWS Amplify / Cognito - Authentication and backend services
- Google Sign-In - Authentication provider
- Expo EAS - App build and update delivery
Understanding the Scores
| Category | Score |
|---|---|
| Security | 85/100 |
| Privacy | 55/100 |
| Data Security | 72/100 |
| Network Security | 85/100 |
| Code Safety | 85/100 |
| Data Collection | 56/100 |
| Data Sharing | 75/100 |
| User Control | 70/100 |
Positive Security Features
- The app includes a library to detect modified device environments, providing an added layer of protection for health data stored locally.
- Authentication is delegated to established providers (Google Sign-In, AWS Cognito) rather than a custom-built system, reducing the risk from authentication mistakes.
Areas for Improvement
- Usage behavior is shared with several analytics and data-routing services simultaneously. Providing an opt-out or reducing the number of recipients would meaningfully improve user privacy.
- How sensitive health data is stored on the device could be strengthened to better protect biomarker records if the device is ever accessed by someone else.
- Some network connections could be configured more strictly to better protect data while it travels between the app and its servers.
About This Analysis
This scorecard is generated through automated static analysis of the app's code and configuration. Scores reflect the app's practices at the time of the scan and may not capture all runtime behaviors.
App Details
- App ID: com.bryanjohnson.biomarkers
- Version: 1.0.10 (Build 70)
- Scan Date: 2026-03-31
- Platform: iOS / React Native
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 64/100 |