Scan results

Recommendation: Use With Caution

CITT's analysis of version 1.6.5 (Build 232) found an authentication secret embedded in the app's bundled configuration files, which may allow access to GoodLeap's internal backend services by anyone who obtains the APK. Analytics and marketing services in this build, including RudderStack, Salesforce Marketing Cloud, and Pendo, appear configured to begin data collection at app launch without a consent gate. Login session data uses hardware-backed encryption and the login flow uses a browser-based approach with a secure verification step, which are meaningful security strengths for a financial app handling payment data.

Key Findings

Data Security: 3 findings (1 critical, 2 medium)

Network Security: 1 finding (1 high)

Code Safety: 5 findings (2 medium, 3 low)

Privacy: 4 findings (3 medium, 1 low)

Privacy Concerns

What Leaves the Device

• Behavioral event data and advertising identifier: the build links RudderStack and configures it to gather app event data and the Google Advertising ID; no advertising opt-out check was found in the analyzed build, though server-side controls were not tested.
• Marketing interactions and push preferences: Salesforce Marketing Cloud is initialized at launch in the build's configuration without a consent gate; the SDK is designed to send contact identifiers and push registration data to Salesforce servers, though runtime transmission was not observed.
• In-app session interaction data: the Pendo SDK's screen capture and session recording features are linked and registered in this build; whether captured frames are sent to Pendo servers and how financial screens are masked depends on runtime configuration not inspectable from the binary.
• App event data: the Facebook App Events SDK is linked in this build and may send app interaction data to Facebook; runtime behavior was not observed.
• Performance and error diagnostics: Datadog RUM is linked in the build for performance monitoring and may send diagnostic data to Datadog servers; runtime behavior was not observed.
• Payment processing: payment data is sent to Stripe to process transactions.
• Authentication: login flows are handled via Auth0 as the identity provider.
• Push notifications: delivery is handled via Firebase Cloud Messaging.

What Stays on the Device

• Login session data: stored with hardware-backed encryption on the device, protecting it from access by other apps installed on the same device. This data does not leave the device.

Third-Party Data Sharing

Third parties that may receive data from the app:

• RudderStack - behavioral analytics and advertising identifier collection
• Salesforce Marketing Cloud - marketing automation, push notifications, and analytics
• Pendo - session analytics and screen interaction recording
• Facebook App Events - app event analytics
• Datadog RUM - performance and error monitoring
• Auth0 - user authentication
• Stripe - payment processing
• Firebase - push notification delivery
• LaunchDarkly - feature flag management

Understanding the Scores

Security: 65/100
Privacy: 78/100

Security Breakdown

• Data Security: 65/100. This build bundles authentication configuration files containing embedded secrets, as well as development and sandbox environment configuration files that should not be present in a production release. App data backup to cloud storage is also not restricted in this build's configuration.
• Network Security: 75/100. The network security configuration in this build explicitly permits unencrypted HTTP communication to one server address, overriding Android's default enforcement of encrypted connections for that host.
• Code Safety: 80/100. The login flow uses a browser-based approach with a secure code-exchange verification step, and device integrity and tamper detection are implemented. Several routing components in the analyzed build accept external navigation inputs without host restrictions, which may be addressable in a future release.

Privacy Breakdown

• Data Collection: 74/100. The build links multiple analytics and marketing services, including behavioral tracking and a session recording SDK. Advertising identifier collection does not appear gated on user opt-out status in the analyzed build.
• Data Sharing: 80/100. Data is shared with a defined set of service providers for analytics, marketing, authentication, and payment processing. No SDK serving display advertisements to users was found in this build; ad-related permissions appear tied to attribution and analytics functions rather than ad delivery.
• User Control: 72/100. The developer's Google Play listing states users can request data deletion. Analytics services in this build appear configured to initialize without a pre-launch consent step, which may limit a user's ability to opt out before behavioral data is sent to third parties.

Positive Security Features

• Login session data is stored using hardware-backed encryption, keeping it on the device and inaccessible to other apps.
• The login flow uses a browser-based approach with a secure code-exchange verification step, avoiding the practice of handling account login information inside the app itself.
• Device integrity and tamper detection are implemented via dedicated libraries.
• No SDK serving display advertisements to users was found in this build; ad-related permissions in the manifest appear limited to attribution and analytics purposes.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Analytics consent timing
   Google Play's data safety section (retrieved 2026-08-11) states the app may share location and personal information with third parties. The analyzed build links RudderStack, Salesforce Marketing Cloud, and Pendo in configurations that appear to initialize data collection at launch. Google's developer policies recommend presenting collection disclosures before data is gathered; whether server-side consent controls satisfy this requirement could not be determined from the binary alone.

2. Advertising permissions scope
   The AndroidManifest.xml in this build declares all four Android Privacy Sandbox advertising permissions, including the Protected Audience API permission for interest-group behavioral targeting. Google Play's published Privacy Sandbox guidance notes these permissions are intended for advertising-supported apps. GoodLeap Home's Play Store listing does not describe an advertising model, so a reader comparing the manifest against the store listing would find this combination unexpected for a financial services app.

Security Enhancements

1. Authentication secret management
   Industry practice for mobile applications recommends that machine-to-machine authentication secrets be held server-side rather than bundled in the distributed app. Moving these secrets to a backend service would prevent recovery from downloaded app files.

2. Build artifact scope
   This production build bundles development and sandbox environment configuration files alongside production configuration. Restricting the release build to production-environment assets only would reduce exposure of internal service configuration.

3. Network communication encryption
   Removing the cleartext HTTP permission for the specific server address in the network security configuration would ensure all network communication in the app remains encrypted in transit.

Technical Context

App Type: Financial services - home loan management and solar monitoring
Classes Analyzed: 25,413
Third-Party Services: 19 identified
Context Tags: financial, sensitive_data, ads, location, contacts

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: GoodLeap, LLC
Version: 1.6.5 (Build 232)
Analysis Date: 2026-08-12
Package: com.goodleap.homeowner

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.6.5 analyzed on 2026-08-12
• May not reflect server-side security controls
• Cannot detect all runtime behaviors