GitHub Security & Privacy Scorecard

GitHub

What This Means for You

User activity is reported to Firebase, including crash diagnostics and session data. Code, repositories, and account interactions are processed on GitHub servers, and Firebase services collect usage patterns from user sessions. Users have reasonable control over their account data, but third-party reporting runs in the background whenever the app is in use.

Recommendation: Use With Caution

Best For: Developers comfortable with standard crash reporting

Key Findings

Data Security - 6 findings (1 critical, 2 high, 3 medium)

Network Security - 0 findings

Code Safety - 0 findings

Privacy - 4 findings (1 critical, 3 medium)

Privacy Concerns

What Data is Collected

Firebase services collect crash diagnostics, session identifiers, device information, and usage patterns each time the app is opened and used. Account activity, including repository interactions and code browsing, is processed on GitHub's servers.

Third-Party Data Sharing

Session and diagnostic data is shared with Google's Firebase platform, which processes crash reports and usage analytics. Firebase Cloud Messaging routes notification delivery through Google's infrastructure using device registration data.

Understanding the Scores

Positive Security Features

• No specific positive security practices were identified for this app.

Areas for Improvement

• Data handling practices could be strengthened to better protect sensitive information stored and processed on the device.
• The range of data collected by background analytics services could be narrowed to what is strictly needed for core functionality.
• Providing clearer controls for managing background reporting would give users more visibility into what information leaves the device.

About This Analysis

App Details