GoodLeap Home Security & Privacy Scorecard
Android
In-app activity is shared with Facebook and multiple behavioral analytics platforms, so loan management habits can inform ad targeting across the web. Some data traveling between the device and the app's servers is sent with less protection than expected. The app also includes a proximity beacon SDK that can detect a user's physical presence near registered beacons.
Best for
Homeowners managing a GoodLeap solar or home loan
Avoid if
Users who don't want loan activity shared with Facebook
Findings
- 1 critical
- 1 high
- 6 medium
- 4 low
- 5 info
17 issues identified across security and privacy analysis.
Top security issues
- Cleartext HTTP Traffic Explicitly Allowed for AWS EC2 Server
- Facebook OAuth Tokens Stored in Plain SharedPreferences
- Stripe Fraud Detection Data Stored Unencrypted
Top privacy issues
- Pre-Consent Facebook Analytics Tracking (GDPR Violation)
- Salesforce Marketing Cloud Pre-Consent Initialization
- Multiple Exported OAuth Callback Activities Without Permission Protection
Full analysis
GoodLeap Home
What This Means for You
In-app activity is shared with Facebook and multiple behavioral analytics platforms, so loan management habits can inform ad targeting across the web. Some data traveling between the device and the app's servers is sent with less protection than expected. The app also includes a proximity beacon SDK that can detect a user's physical presence near registered beacons.
Recommendation: Use With Caution
Best For: Homeowners managing a GoodLeap solar or home loan
Avoid If: Users who don't want loan activity shared with Facebook
Key Findings
Data Security - 7 findings (4 medium, 1 low, 2 info)
Network Security - 3 findings (1 critical, 2 info)
Code Safety - 0 findings
Privacy - 2 findings (1 high, 1 medium)
Privacy Concerns
What Data is Collected
GoodLeap Home collects loan account activity, device identifiers, and behavioral usage data generated by in-app interactions. Analytics services including Pendo, RudderStack, and Firebase track how users navigate and use features. Datadog collects performance and session information tied to user activity.
Third-Party Data Sharing
Data is shared with the following third-party services:
- Facebook SDK - behavioral and identity data for advertising purposes
- Salesforce Marketing Cloud - contact and engagement data for marketing communications
- Pendo - in-app behavior tracking and product analytics
- RudderStack - event routing to multiple downstream analytics platforms
- Firebase - usage analytics and crash reporting (Google)
- Datadog - application performance monitoring
- Stripe - payment processing
- Auth0 - authentication and identity management
- Google Sign-In - identity verification
- AltBeacon - Bluetooth proximity detection near registered beacons
Understanding the Scores
| Category | Score |
|---|---|
| Security | 68/100 |
| Privacy | 86/100 |
| Data Security | 58/100 |
| Network Security | 54/100 |
| Code Safety | 94/100 |
| Data Collection | 88/100 |
| Data Sharing | 100/100 |
| User Control | 88/100 |
Positive Security Features
No notable positive security practices were identified for this version of the app.
Areas for Improvement
- Some connections between the app and its servers lack consistent protection, which means loan account information may not be fully protected while in transit.
- In-app activity is routed to Facebook and several behavioral analytics services by default, with minimal controls available to limit that sharing.
- The app includes a Bluetooth proximity detection feature that can register a user's physical location near beacons, a capability that goes beyond what most users would expect from a loan management app.
About This Analysis
This scorecard reflects automated static analysis of the app's code and configuration. Results represent the security and privacy posture of the specific version analyzed.
App Details
- App: GoodLeap Home
- Package: com.goodleap.homeowner
- Version: 1.3.7 (build 188)
- Scan Date: March 26, 2026
- Total Findings: 17 (1 critical, 1 high, 6 medium, 4 low, 5 info)
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 73/100 |