Scan results

Recommendation: TRUSTish

The configuration bundle in this build ships production service secrets for GM's Azure API management layer, HERE Maps, Telenav navigation, and Arity telematics, all extractable from the downloadable IPA. The login and session layer is separately protected: account data is stored in the iOS Keychain with biometric binding, and core vehicle service traffic is secured against network interception across all primary GM backend domains. CITT rates this TRUSTish because the exposed secrets concern GM's server-side infrastructure rather than direct access to individual user accounts or vehicle controls, and the protective measures around user login and network traffic are strong.

Key Findings

Data Security: 6 findings (1 critical, 4 high, 1 low)

Network Security: 0 findings

Code Safety: 2 findings (2 low)

Privacy: 2 findings (1 medium, 1 low)

Privacy Concerns

What Leaves the Device

• Behavioral data attributed to account identity: may be sent to ContentSquare (Heap) for product analytics, as declared in the Heap privacy manifest bundled with this build.
• Vehicle push notification content (remote start alerts, lock/unlock status, charging events): captured by the Heap notification component and may be sent to ContentSquare; runtime transmission was not observed.
• In-app web content request and response data: the LuciqSDK (Instabug) bundle is configured to capture this data and forward it to GM's Instabug instance; runtime transmission was not observed.

What Stays on the Device

• Account login data: stored in the iOS Keychain with the highest protection class, including biometric binding. This data is not evidenced as leaving the device and stays under the user's control on the original device.

Third-Party Data Sharing

Third parties that may receive data from the app:

• ContentSquare (Heap) - behavioral analytics linked to account identity
• Instabug (LuciqSDK) - crash reporting and in-app web content monitoring
• AppsFlyer - install attribution, gated on ATT consent
• Firebase - push notification delivery
• Adobe AEP - analytics and personalization
• Salesforce - customer relationship management
• Datadog - performance monitoring
• HERE Maps - mapping and navigation
• Telenav - navigation and entity search
• Arity (Allstate) - telematics and roadside assistance

Understanding the Scores

Security: 47/100
Privacy: 83/100

Security Breakdown

• Data Security: 50/100. The configuration bundle ships production service authentication secrets for five external platforms. Login data is separately protected by the iOS Keychain with biometric binding, and cross-app data access is restricted to General Motors' own brand applications.
• Network Security: 87/100. Transport security for core vehicle service traffic is strong. GM's ten primary backend domains are protected against network interception, and standard secure transport applies across analytics and third-party service connections.
• Code Safety: 70/100. Build automation scripts and non-production environment references are present in the production bundle, exposing internal infrastructure detail. No memory safety issues were identified in the native compiled binary.

Privacy Breakdown

• Data Collection: 86/100. Firebase Analytics is explicitly disabled across all environments; the SDK is present for push notifications only, not behavioral data. Analytics data collection is limited relative to the number of third-party frameworks linked in this build.
• Data Sharing: 88/100. Data flows are largely restricted to functional and operational services. Behavioral analytics via Heap attributed to account identity is the primary discretionary sharing surface.
• User Control: 90/100. Advertising attribution is gated behind ATT consent, giving users direct control over advertising identifier access.

Positive Security Features

• Firebase Analytics is disabled in all build environments; the SDK is present only for push notifications, not behavioral data collection.
• Account login data is stored in the iOS Keychain with the strongest protection class, including biometric binding that prevents extraction.
• Core vehicle service traffic to GM's ten primary backend domains is protected against network interception.
• Automated static analysis found no memory safety issues in the native compiled binary.
• AppsFlyer advertising attribution is gated behind ATT consent; advertising identifiers are not accessed without explicit user permission.
• Datadog performance monitoring in this build does not include session replay, limiting what performance data may leave the device.
• Cross-app data access is restricted to General Motors' own four brand applications under a single developer team; no third-party infrastructure can access these shared stores.

Areas for Improvement

Disclosure Observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Behavioral analytics attribution disclosure
   Apple's App Store privacy label guidance requires that data attributed to user identity be declared under the appropriate category. The Heap privacy manifest bundled with this build declares user identity linked to analytics. A reader comparing the App Store privacy label to the binary-linked Heap manifest may find the full scope of identity-attributed behavioral data is not prominently surfaced in the top-level label. Whether the label fully reflects the current state could not be determined from the build alone.

2. App privacy manifest coverage
   An app privacy manifest (PrivacyInfo.xcprivacy) for the main app binary was not identified in this build. Adding one could make the App Store privacy label more complete by surfacing required-reasons API usage declared directly by the host app.

Security Enhancements

1. Service authentication secrets in the configuration bundle
   Service secrets for external platforms should be fetched at runtime from a protected server-side configuration service rather than stored in the downloadable app bundle. This change would eliminate the exposure for all affected integrations in a single architectural step.

2. Build artifacts in production IPA
   CI automation scripts, internal proxy references, and non-production environment entries are present in the production build. Removing these from the packaging step would reduce the internal infrastructure detail available in a distributed IPA.

3. Keychain item backup eligibility
   Several Keychain items use a protection class that makes them eligible for inclusion in encrypted iCloud backups, allowing restoration to a different device. Using the device-bound protection class would restrict these items to the original device and raise the bar for credential extraction.

Technical Context

App Type: Connected vehicle remote control (location, financial, sensitive data)
Classes Analyzed: 300
Third-Party Services: 21
Context Tags: location, financial, sensitive_data, camera, ads

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: General Motors (GM)
Version: 8.15.0 (Build 8113)
Analysis Date: 2026-08-26
Package: com.gm.myGMC

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 8.15.0 (Build 8113) analyzed on 2026-08-26
• May not reflect server-side security controls
• Cannot detect all runtime behaviors