Skimmer Pro Security & Privacy Scorecard

Android

48
Overall trust score
Unsafe
45
Security
50
Privacy

Usage patterns and behavior are tracked by Pendo Analytics and shared with Sentry for error reporting. A critical finding was identified, meaning account data may not be fully protected. Google Sign-In links user activity to their Google account.

Best for

Pool service pros comfortable with standard analytics

Findings

  • 1 critical
  • 4 high
  • 7 medium
  • 5 low
  • 0 info

0 issues identified across security and privacy analysis.

Top security issues

  • Exposed Google Maps API Key Without Restrictions
  • JavaScript Interface RCE Vector in HybridWebView
  • Stored XSS Vulnerability in Rich Text Editor

Top privacy issues

  • Privacy Declaration Contradicts Actual Data Sharing
  • Unencrypted PII in Sentry Crash Reports
  • PII in Analytics Events Without Consent

Full analysis

Skimmer Pro

What This Means for You

Usage patterns and behavior are tracked by Pendo Analytics and shared with Sentry for error reporting. A critical finding was identified, meaning account data may not be fully protected. Google Sign-In links user activity to their Google account.

Recommendation: Use With Caution

Best For: Pool service pros comfortable with standard analytics

Key Findings

Data Security - 4 findings (1 critical, 2 medium, 1 low)

Network Security - 0 findings

Code Safety - 0 findings

Privacy - 5 findings (3 high, 2 medium)

Privacy Concerns

What Data is Collected

In-app activity and feature usage are collected by Pendo Analytics, which builds a profile of how users interact with the app over time. Error and crash data, which may include device details and app state at the time of a problem, are sent to Sentry. Location access is required for Google Maps features. Signing in with Google ties app identity to the user's broader Google account. Bluetooth device information is handled locally by Shiny Bluetooth LE when connecting to compatible hardware.

Third-Party Data Sharing

Usage data is shared with Pendo Analytics and error data with Sentry. Google receives location requests and account information through Maps and Sign-In. Azure Mobile Services processes data on the backend. Multiple parties receive data generated by everyday use of the app, and the controls available to users over that sharing are limited.

Understanding the Scores

Category Score
Overall Security 45/100
Overall Privacy 50/100
Data Security 70/100
Network Security 80/100
Code Safety 40/100
Data Collection 55/100
Data Sharing 50/100
User Control 60/100

Positive Security Features

  • Network communications between the app and its servers score relatively well, suggesting data moving between the device and the backend receives a reasonable level of protection in transit.
  • Account login is handled through Google Sign-In, an externally managed identity provider, which means password management is delegated to a widely-used and maintained system rather than built in-house.

Areas for Improvement

  • A critical issue in how account data is stored or handled puts it at greater risk than it should be. Stronger protections are needed to keep user information secure at rest.
  • The app's code safety practices scored low, meaning user data may not be well-protected at the code level against unauthorized access by other software on the device.
  • Data flows to several third-party services with limited controls offered to users over what is shared and with whom. Clearer opt-out options would give users more confidence in how their information is used.

About This Analysis

This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed at the time of the scan.

App Details

  • App: Skimmer Pro
  • Package: com.getskimmer.skimmerphone
  • Version: 12.8.2 (Build 27529)
  • Scan Date: 2026-02-07
  • Platform: Android

Versions & scan history

ScanDateOverall score
#2 (current) 48/100