Skimmer Pro Security & Privacy Scorecard
Android
Usage patterns and behavior are tracked by Pendo Analytics and shared with Sentry for error reporting. A critical finding was identified, meaning account data may not be fully protected. Google Sign-In links user activity to their Google account.
Best for
Pool service pros comfortable with standard analytics
Findings
- 1 critical
- 4 high
- 7 medium
- 5 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Exposed Google Maps API Key Without Restrictions
- JavaScript Interface RCE Vector in HybridWebView
- Stored XSS Vulnerability in Rich Text Editor
Top privacy issues
- Privacy Declaration Contradicts Actual Data Sharing
- Unencrypted PII in Sentry Crash Reports
- PII in Analytics Events Without Consent
Full analysis
Skimmer Pro
What This Means for You
Usage patterns and behavior are tracked by Pendo Analytics and shared with Sentry for error reporting. A critical finding was identified, meaning account data may not be fully protected. Google Sign-In links user activity to their Google account.
Recommendation: Use With Caution
Best For: Pool service pros comfortable with standard analytics
Key Findings
Data Security - 4 findings (1 critical, 2 medium, 1 low)
Network Security - 0 findings
Code Safety - 0 findings
Privacy - 5 findings (3 high, 2 medium)
Privacy Concerns
What Data is Collected
In-app activity and feature usage are collected by Pendo Analytics, which builds a profile of how users interact with the app over time. Error and crash data, which may include device details and app state at the time of a problem, are sent to Sentry. Location access is required for Google Maps features. Signing in with Google ties app identity to the user's broader Google account. Bluetooth device information is handled locally by Shiny Bluetooth LE when connecting to compatible hardware.
Third-Party Data Sharing
Usage data is shared with Pendo Analytics and error data with Sentry. Google receives location requests and account information through Maps and Sign-In. Azure Mobile Services processes data on the backend. Multiple parties receive data generated by everyday use of the app, and the controls available to users over that sharing are limited.
Understanding the Scores
| Category | Score |
|---|---|
| Overall Security | 45/100 |
| Overall Privacy | 50/100 |
| Data Security | 70/100 |
| Network Security | 80/100 |
| Code Safety | 40/100 |
| Data Collection | 55/100 |
| Data Sharing | 50/100 |
| User Control | 60/100 |
Positive Security Features
- Network communications between the app and its servers score relatively well, suggesting data moving between the device and the backend receives a reasonable level of protection in transit.
- Account login is handled through Google Sign-In, an externally managed identity provider, which means password management is delegated to a widely-used and maintained system rather than built in-house.
Areas for Improvement
- A critical issue in how account data is stored or handled puts it at greater risk than it should be. Stronger protections are needed to keep user information secure at rest.
- The app's code safety practices scored low, meaning user data may not be well-protected at the code level against unauthorized access by other software on the device.
- Data flows to several third-party services with limited controls offered to users over what is shared and with whom. Clearer opt-out options would give users more confidence in how their information is used.
About This Analysis
This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed at the time of the scan.
App Details
- App: Skimmer Pro
- Package: com.getskimmer.skimmerphone
- Version: 12.8.2 (Build 27529)
- Scan Date: 2026-02-07
- Platform: Android
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #2 (current) | 48/100 |