Scan results

Recommendation: Significant Security Concerns

High-risk findings include a hardcoded internal communication channel exposed in the app binary, an unencrypted financial database, and push notification handling that can load arbitrary web pages inside the app. Users who require strong financial data security or who use modified devices should evaluate alternative apps before trusting MoneyCoach with their full financial picture.

Key Findings

Data Security - 4 findings (1 medium, 1 low, 2 info)

Network Security - 3 findings (2 medium, 1 low)

Code Safety - 3 findings (1 high, 1 low, 1 info)

Privacy - 3 findings (1 medium, 2 info)

Privacy Concerns

What Data is Collected

• Financial data: transactions, accounts, credit card details, loan schedules, budgets
• Device information: advertising identifier (IDFA), device model, operating system
• Apple Wallet data: payment card transactions (via FinanceKit with your permission)
• Usage data: in-app interactions, feature engagement, subscription events

Third-Party Data Sharing

The following third parties may receive your data:

• Firebase Analytics - usage and behavior analytics
• Firebase Crashlytics - crash and error reporting
• Google Ads On-Device Conversion - advertising performance measurement, receives device advertising ID
• Mixpanel - behavioral analytics (routed via EU endpoint for GDPR compliance)
• RevenueCat - subscription and purchase management, may receive email and display name
• Branch.io - install attribution and marketing analytics
• SuperwallKit - paywall and subscription offer optimization
• GoCardless (Nordigen) - open banking connections (required for bank account integration)
• Tally.so - in-app forms and surveys

Understanding the Scores

Security: 83/100
Privacy: 91/100

Security Breakdown

• Data Security: 72/100 - Financial data stored without the strongest protection settings; some file access controls weaker than expected for a finance app
• Network Security: 83/100 - Allows unencrypted connections to its own domain and loads external URLs from push notifications without validation
• Code Safety: 82/100 - An internal communication channel is exposed in the production binary; development test files were included in the public release

Privacy Breakdown

• Data Collection: 90/100 - Collects financial and device data appropriate to core features; ATT permission prompt shown before advertising ID access
• Data Sharing: 93/100 - Data shared with multiple analytics and advertising services; GDPR-aware routing via Mixpanel EU endpoint
• User Control: 93/100 - Standard iOS permission model in use; FinanceKit access can be revoked

Positive Security Features

• Sensitive items such as session data and signing keys are stored in the iOS Keychain using hardware-backed protection, scoped to a single narrow access group
• No JavaScript-to-native communication bridge is exposed inside the in-app browser, reducing the attack surface for malicious web content
• Apple Wallet access via FinanceKit is accurately described in the permission prompt and properly declared in the app's privacy manifest
• Mixpanel analytics are routed through an EU endpoint, supporting GDPR-compliant data handling
• The advertising identifier access is gated behind Apple's App Tracking Transparency permission prompt

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Accurate Tracking Disclosure
   The app's privacy manifest currently declares that the device advertising ID is not used for tracking, while the app sends it to Google Ads for conversion measurement. Aligning these declarations with actual data flows would give users accurate information before they consent.

2. Clearer Disclosure of Analytics Partners
   The full list of analytics, attribution, and advertising services (including Branch.io, SuperwallKit, and RevenueCat attribution features) could be more transparently surfaced to users before account creation.

Security Enhancements

1. Strengthen Financial Data Protection at Rest
   The financial database and associated files could adopt stronger iOS Data Protection settings so that stored data remains inaccessible when the device is locked, consistent with industry practice for finance applications.

2. Push Notification URL Validation
   URLs delivered via push notifications that open in an in-app browser should be validated against an allowlist of trusted domains before loading, preventing crafted notifications from directing users to unexpected web pages.

Technical Context

App Type: Personal finance aggregation and budgeting, high sensitivity
Classes Analyzed: iOS binary symbols and headers (static analysis, no Binary Ninja pass)
Third-Party Services: 12 identified
Context Tags: financial, sensitive_data, ads

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Duuro
Version: 11.3 (Build 1156)
Analysis Date: 2026-04-17
Package: com.duuro.moneyCoach

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 11.3 (Build 1156) analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors