Scan results

Recommendation: Elevated Risk

CITT scores this build at 50/100. The tunnel technology is robust: WARP API connections are validated against more than 120 pre-approved server identities and authorization data is stripped from diagnostic logs. The score is pulled down by account session data stored without encryption in a location that Android cloud backup may include, and by Firebase Analytics being configured to initialize before a user consent interaction.

Key Findings

Data Security - 2 findings (1 medium, 1 low)

Network Security - 2 findings (1 medium, 1 low)

Code Safety - 2 findings (2 low)

Privacy - 2 findings (2 low)

Privacy Concerns

What Leaves the Device

• Account identifier (WARP registration ID): configured to be sent to Google (Firebase Crashlytics) on app crash, alongside app mode and connection type data.
• Analytics usage data: may be sent to Firebase Analytics; the build explicitly disables linking to the device advertising ID, but general usage analytics data may still be forwarded.
• Attribution measurement data: the build grants Privacy Sandbox attribution access to all SDKs in the process without per-SDK restrictions, so any present SDK may participate in attribution reporting.

What Stays on the Device

• Location data: read from the device for the Trusted Networks feature (to identify the current Wi-Fi network name) and kept on the device. No coordinates are transmitted.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Firebase Crashlytics (Google) - crash reports and a persistent account identifier
• Firebase Analytics (Google) - app usage analytics; advertising ID linking is explicitly disabled
• Firebase Cloud Messaging (Google) - push notification delivery
• Firebase Installations (Google) - app instance identification
• Google Ad Services (Privacy Sandbox) - attribution measurement
• Zendesk - in-app support requests and help center access
• Google Play Billing - subscription management for the WARP+ paid tier

Understanding the Scores

Security: 85/100
Privacy: 35/100

Security Breakdown

• Data Security: 75/100. The WireGuard private key is protected using hardware-backed encryption. Account session data, however, is stored in standard device storage without a separate encryption layer, and the backup configuration may include those files in Android cloud backup.
• Network Security: 83/100. WARP API connections are validated against more than 120 pre-approved server identities, making network interception of VPN tunnel communications infeasible for a rogue certificate. The help center component trusts user-installed certificates and allows mixed content in its article display, which could be relevant on a network with an active interceptor.
• Code Safety: 88/100. Overall code structure is solid. The help center's article display runs with JavaScript enabled, which the Zendesk SDK requires for rendering support content.

Privacy Breakdown

• Data Collection: 55/100. Firebase Analytics may initialize and begin forwarding usage data before the user reaches a consent interaction. The build explicitly disables linking analytics to the device advertising ID, which limits one form of cross-app tracking.
• Data Sharing: 30/100. Usage and crash data are forwarded to multiple Google Firebase services. A persistent account identifier is included in crash reports, creating a data connection between Cloudflare's account system and Google's crash infrastructure that the user cannot independently reset.
• User Control: 40/100. Controls over analytics and crash reporting are limited. The build does not expose a granular opt-out for Firebase data sharing within the app.

Positive Security Features

• The WireGuard private key is protected using hardware-backed encryption on supported Android devices, so it cannot be read even if the device storage is accessed.
• WARP API connections are validated against more than 120 pre-approved server identities, preventing network intermediaries from intercepting VPN tunnel communications.
• Authorization and session headers are stripped from diagnostic logs, preventing account data from appearing in support exports.
• No advertising networks or behavioral profiling SDKs are present in this build.
• Advertising ID collection is explicitly disabled in the build configuration, preventing Firebase from linking analytics events to the device advertising ID.
• Location data accessed for the Trusted Networks feature stays on the device. No coordinates are transmitted.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Cloud Backup Scope
   The build is configured to allow Android cloud backup without declaring which files to exclude. Android platform guidance for android:dataExtractionRules describes how apps can specify exclusions when account session data may be in the backup scope. The Play Store data safety label states that data is encrypted in transit; the backup configuration was not adjusted to reflect whether account session files are excluded.

2. Analytics Initialization Timing
   Firebase Analytics documentation recommends delaying data collection until after a user consent interaction where applicable. Whether the initialization order in this build aligns with the user's consent flow could not be fully determined from static analysis alone; runtime timing was not observed.

Security Enhancements

1. Restrict Cloud Backup Scope
   Adding data extraction rules to the build configuration would allow the app to exclude account session files from Android's automatic cloud backup, reducing the risk of those files being restored to a different device.

2. Restrict Attribution API Access
   The Privacy Sandbox attribution configuration currently grants all SDKs in the process access to attribution data. Per-SDK access controls would limit which components can participate in attribution measurement.

3. Improve Crash Report Data Minimization
   Replacing the persistent account identifier in crash reports with a non-account-linked session identifier would remove the data connection between Cloudflare's account system and Google's crash infrastructure.

Technical Context

App Type: VPN / Network Security Tool
Classes Analyzed: 13,148
Third-Party Services: 10
Context Tags: vpn, network_security, sensitive_data, location, analytics

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Cloudflare, Inc.
Version: 6.38.8 (Build 5431)
Analysis Date: 2026-08-12
Package: com.cloudflare.onedotonedotonedotone

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 6.38.8 analyzed on 2026-08-12
• May not reflect server-side security controls
• Cannot detect all runtime behaviors