Scan results

Recommendation: Solid

CITT rates Fly Delta 72/100 (Solid). The build earns strong marks for network security and applies hardware-protected encryption to authentication session keys and login passwords. Passport and barcode scanning are handled entirely on-device. Two areas weigh on the score: the database storing biometric passwords and user data does not apply encryption, and the build initializes Quantum Metric session replay without a confirmed consent gate, though capture at runtime was not verified.

Key Findings

Data Security: 1 finding (1 high)

Network Security: 0 findings

Code Safety: 4 findings (3 medium, 1 low)

Privacy: 2 findings (2 medium)

Privacy Concerns

What Leaves the Device

• SkyMiles loyalty number: the binary includes code for routing this to Adobe Experience Platform as a persistent cross-device identity anchor in AUTHENTICATED state, used by Adobe Analytics, Target, and Optimize
• Quantum Metric session identifier: the binary includes code that places this identifier in payment API request headers, linking session replay records to specific financial transactions on Delta's booking servers
• Usage and behavioral data: may be sent to Firebase Analytics and Adobe Analytics for measurement and optimization, based on linked SDK code
• Location data: may be sent to Radar SDK for location-based features, based on linked SDK code

What Stays on the Device

• Passport images and barcode data: read and processed on-device by Google ML Kit; no off-device flow for this data was identified in this analysis
• Trip itinerary and calendar data: stored on the device; no off-device flow for this data was identified in this analysis

Third-Party Data Sharing

Third parties that may receive data from the app:

• Adobe Analytics / Adobe Experience Platform - behavioral analytics and cross-device personalization using the SkyMiles loyalty number as a persistent identity
• Firebase Analytics - usage analytics and measurement
• Firebase Crashlytics - crash and stability reporting
• Quantum Metric - session replay and user experience analytics; the session identifier is linked to payment transaction records in API request headers
• Dynatrace - application performance monitoring
• Radar SDK - location services
• OneTrust - consent management
• Google AdServices (Privacy Sandbox) - advertising attribution
• Qualtrics - in-app surveys and user feedback

Understanding the Scores

Security: 75/100
Privacy: 70/100

Security Breakdown

• Data Security: 62/100. The build applies hardware-protected encryption to authentication session keys and login passwords. The local database storing biometric passwords and user data does not apply full database encryption, and the manifest configuration leaves this data included in Android's backup feature.
• Network Security: 100/100. Network connections are configured to use HTTPS, and invalid server certificates are rejected across in-app browser sessions.
• Code Safety: 81/100. The build handles most sensitive operations securely. Test payment card data is compiled into the release binary, a deprecated JavaScript bridge contains code that could make session data available to JavaScript in specific scenarios, and a developer tooling component is present in the production manifest.

Privacy Breakdown

• Data Collection: 64/100. The build links multiple analytics and personalization SDKs. The SkyMiles loyalty number is used as a persistent cross-device identity anchor in Adobe's platform, and usage analytics appear to initialize at app startup.
• Data Sharing: 66/100. Data may reach Adobe Analytics, Firebase Analytics, Quantum Metric, and other analytics, session replay, and advertising services. The Quantum Metric session identifier appears in payment API request headers, linking session records to financial transactions.
• User Control: 74/100. The build integrates OneTrust for consent management. The Play Store Data Safety section discloses that data deletion can be requested.

Positive Security Features

• Authentication session keys and login permissions are protected by Android's hardware security module; the underlying key material does not leave the secure hardware
• Login passwords are encrypted before being written to the database
• Network traffic is configured to use HTTPS, and invalid server certificates are rejected across in-app browser sessions
• Passport scanning and barcode reading are handled on-device; no off-device flow for scanned image data was identified in this analysis
• Trip itinerary and calendar data was not observed being sent to analytics platforms

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. SkyMiles number as behavioral analytics identity anchor
   The Google Play Data Safety label (retrieved 2026-08-11) states the app "may share" personal info and financial info with third parties. The binary contains code for routing the SkyMiles loyalty number to Adobe Experience Platform in AUTHENTICATED state as the primary persistent cross-device identity anchor for Adobe Analytics, Target, and Optimize. The specific use of the loyalty account number as a persistent behavioral profiling identifier is not separately disclosed in the published label. Readers can compare against Delta's privacy policy linked from the Play Store listing.

2. Session replay capability
   The binary links the Quantum Metric SDK, which provides session replay capability. The Play Store Data Safety label does not specifically identify session replay as a data type or collection mechanism. Whether session replay captures data at runtime, or is gated by user consent, was not determined in this static analysis.

Security Enhancements

1. Encrypt sensitive database fields
   The database that stores biometric passwords and user data could be strengthened by applying encryption to sensitive fields or enabling full database encryption, so stored data is not retained without protection.

2. Add Android backup exclusion rules
   Adding backup exclusion rules to the app manifest would prevent the sensitive database and preferences files from being included in Android backup operations. Industry guidance recommends explicitly excluding sensitive data from backup where possible.

3. Remove deprecated session data bridge
   The build contains a deprecated JavaScript bridge capable of making session data available to the JavaScript engine. Completing its removal would eliminate this residual code path.

4. Remove test payment data from production build
   Test payment card data compiled into the release binary reveals payment form field names and processing paths. Removing these fixtures before production release is standard practice.

Technical Context

App Type: Travel and loyalty (financial, identity, and location data)
Classes Analyzed: 2,400
Third-Party Services: 29
Context Tags: financial, travel, sensitive_data, location, camera

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Delta Air Lines, Inc.
Version: 7.14 (versionCode 24428)
Analysis Date: 2026-08-12
Package: com.delta.mobile.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 7.14 analyzed on 2026-08-12
• May not reflect server-side security controls
• Cannot detect all runtime behaviors