Scan results

Recommendation: TRUSTED

CITT rates this build at 86/100. Camera effects are computed on-device, all network connections use standard TLS, and no behavioral analytics or session-recording SDKs are present. The over-the-air JavaScript update mechanism checks for updates on every launch; developer code signing is not applied to those bundles in this build, which is the primary area for the developer to address.

Key Findings

Data Security: 2 findings (2 low)

Network Security: 0 findings

Code Safety: 3 findings (1 high, 2 low)

Privacy: 1 finding (1 low)

Privacy Concerns

What Leaves the Device

• Device advertising identifier and app activity data: shared with Google AdMob for ad delivery, consistent with the Play Store data safety disclosure (retrieved 2026-08-26)
• Device identifiers registered for push notifications: shared with Firebase Cloud Messaging and OneSignal to deliver push notifications
• Device installation identifiers: shared with Firebase Installations for service registration
• Subscription and purchase state: shared with RevenueCat, Google Play Billing, and Amazon IAP to manage in-app entitlements
• JavaScript bundle update requests: made to Expo EAS update servers on each app launch

What Stays on the Device

• Camera images and video frames: processed on-device via WebGL shaders; no network transmission path for photo or video data was identified in this build, meaning camera output stays under the user's control.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google AdMob - Advertising delivery and targeting
• Firebase Cloud Messaging - Push notification delivery
• Firebase Installations - Device registration for Firebase services
• OneSignal - Push notification delivery
• RevenueCat - In-app subscription and purchase management
• Google Play Billing - In-app purchase processing
• Amazon IAP - In-app purchase processing
• Expo EAS Updates - Over-the-air JavaScript bundle delivery
• PairIP - License verification

Understanding the Scores

Security: 85/100
Privacy: 90/100

Security Breakdown

• Data Security: 88/100. Sensitive data is protected using hardware-backed encryption. Two low-severity configuration items are noted in Areas for Improvement.
• Network Security: 100/100. All network connections use standard TLS; no weakened or bypassed configuration was identified in this build.
• Code Safety: 88/100. Hardware-backed secret storage is implemented correctly. The over-the-air update mechanism does not apply developer code signing to received bundles in this build; this is noted in Areas for Improvement.

Privacy Breakdown

• Data Collection: 92/100. Camera and video processing stays on the device. Device advertising identifiers and app activity signals are shared with advertising services, consistent with the Play Store data safety disclosure.
• Data Sharing: 95/100. Data shared off the device is limited to advertising, push notification, subscription management, and license services that are functional to the app's operation.
• User Control: 92/100. Standard Android permission controls govern camera and storage access. The advertising identifier may be reset or removed through Android's privacy settings.

Positive Security Features

• All network connections use standard TLS; no weakened or bypassed configuration was identified in this build.
• Camera images and video frames are processed on-device; no network transmission path for photo or video data was identified in this build.
• Sensitive secrets are stored using hardware-backed encryption provided by the Android KeyStore.
• Firebase is linked for push notification delivery only; no behavioral analytics or session-recording use was identified for Firebase in this build.
• No session-recording or screen-observation SDKs are present in this build.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Advertising Consent Ordering
   The Play Store data safety section (retrieved 2026-08-26) declares that device identifiers may be shared with third parties and that data cannot be deleted. The build links Google AdMob. Whether advertising consent is requested before the advertising identifier is read is determined at the JavaScript runtime layer and was not statically verifiable from this build alone.

Security Enhancements

1. Over-the-Air Update Code Signing
   The build includes Expo's code signing infrastructure but no developer certificate is configured, so JavaScript bundles received from Expo's update servers are accepted based on the TLS channel alone. Enabling Expo's code signing with a developer certificate would add a cryptographic check that each update originated from the developer's own account.

2. Android Backup Scope
   Two backup exclusion rule files are present in the APK but are not referenced in the manifest, so Android backs up all app data without restriction. Wiring these files to the manifest's backup rule attributes would limit what app data is included in device backups.

3. Production Build Cleanup
   The production build includes a file-sharing path scoped to the full external storage root rather than a specific directory, a development tool activity marked as externally accessible, and a local development server address in the resource strings. Scoping the file-sharing path to the intended directory, removing the development activity's external accessibility flag, and cleaning the resource string would reduce the build's surface area.

Technical Context

App Type: Entertainment - Real-time camera filter and animal vision simulator
Classes Analyzed: 34,843
Third-Party Services: 11
Context Tags: camera, ads

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Codixus (Metehan Kurucu)
Version: 1.5.0 (Build 15)
Analysis Date: 2026-08-26
Package: com.codixus.catlens.app

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.5.0 analyzed on 2026-08-26
• May not reflect server-side security controls
• Cannot detect all runtime behaviors