Scan results

Recommendation: Elevated Risk

CITT rates this build Elevated Risk. Six analytics and advertising frameworks are integrated alongside the VPN engine, with VPN usage events instrumented in ways that may support external reporting, though runtime data flows were not observed. The core code safety and data security implementations score well; the low privacy scores reflect the breadth of third-party data sharing present in the binary, which may be a material consideration for users who install a VPN to reduce external data exposure.

Key Findings

Data Security: 0 findings

Network Security: 0 findings

Code Safety: 1 finding (1 low)

Privacy: 1 finding (1 medium)

Privacy Concerns

What Leaves the Device

• VPN usage events (connection timing, server selection, protocol choices, subscription actions): the binary links Firebase Analytics and Mixpanel and contains VPN-specific event strings, indicating these events may be reported to those services; runtime transmission was not observed.

• Advertising attribution signals: the binary links GoogleAdsOnDeviceConversion and SKAdNetwork frameworks and contains Google advertising service URLs, indicating attribution data may be shared with advertising measurement services; runtime transmission was not observed.

What Stays on the Device

• WireGuard session keys remain in memory and are not written to disk, keeping them on the device rather than in persistent storage.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google (Firebase Analytics, Firebase Crashlytics, Firebase Performance Monitoring, GoogleAdsOnDeviceConversion) - usage analytics, crash reporting, and advertising attribution
• Mixpanel - product analytics
• OneSignal - push notification delivery
• Branch.io - attribution and app linking
• Singular (via SKAdNetwork / app-analytics-services.com) - ad campaign attribution

Understanding the Scores

Security: 82/100
Privacy: 28/100

Security Breakdown

• Data Security: 87/100. Strong handling of stored data. WireGuard session keys remain in memory and are not persisted to disk, and App Groups are scoped to the developer's own Team ID.

• Network Security: 78/100. The build links WireGuard and OpenVPN with a current OpenSSL library, providing solid VPN protocol coverage. Ensuring all in-app network connections meet the system's security requirements could raise this score further.

• Code Safety: 90/100. Strong code safety profile. No browser bridge or JavaScript execution surface is present in the binary, and device attestation via DeviceCheck is integrated.

Privacy Breakdown

• Data Collection: 20/100. The binary links six analytics and advertising frameworks alongside the VPN engine, with VPN connection event strings compiled in suggesting broad usage-pattern instrumentation; off-device data flows were not confirmed by runtime testing.

• Data Sharing: 25/100. The binary references URLs and frameworks for multiple advertising and analytics services, indicating usage data may reach several third parties.

• User Control: 35/100. A server-side analytics control mechanism is present via Firebase Remote Config. Whether a user-facing consent gate governs the default state of analytics sharing could not be determined from static analysis.

Positive Security Features

• WireGuard session keys are kept in memory only and are not written to disk

• No browser bridge or JavaScript execution surface is present in the binary

• App Groups are scoped to the developer's own Team ID, meaning third-party frameworks are not included in the shared container entitlement

• The binary links OpenSSL 3.6.3, a current version

• The AdSupport framework is not linked in this build, meaning IDFA-based advertising identifiers are not available to the binary

• A server-side analytics control mechanism is present via Firebase Remote Config

• The build links WireGuard and OpenVPN, two current VPN protocols

Areas for Improvement

Disclosure Observations

1. Analytics and Advertising SDK Disclosure
   Apple's App Store privacy label guidelines (https://developer.apple.com/app-store/app-privacy-details/) require disclosure of data types shared with third parties. The binary links Firebase Analytics, Mixpanel, OneSignal, Branch.io, GoogleAdsOnDeviceConversion, and SKAdNetwork frameworks alongside VPN connection event strings. Whether the current App Store privacy label for this build fully accounts for all data flows associated with these integrations could not be determined from the binary alone.

2. App Privacy Manifest
   Adding an app privacy manifest (PrivacyInfo.xcprivacy) could make the App Store privacy label more complete for the analytics and advertising SDK dependencies bundled in this build.

Security Enhancements

1. Local Storage Encryption
   The binary links SQLite for local data storage. Enabling encryption for locally stored VPN configuration data would reduce exposure if a device backup is accessed by an unintended party.

2. URL Scheme Input Handling
   The binary registers the urbanvpn:// scheme. Confirming that the URL handler applies strict parameter validation would guard against other apps on the same device passing unexpected inputs.

3. Analytics Default State
   Industry practice for privacy-sensitive applications recommends that analytics data sharing be off by default or require explicit user consent before the first reporting event. Whether such a gate is present in this build could not be confirmed from static analysis.

Technical Context

App Type: VPN and network privacy tool
Classes Analyzed: 183
Third-Party Services: 17 third-party dependencies identified
Context Tags: vpn, security, privacy, ads, analytics

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Not available
Version: 4.3.4 (Build 309)
Analysis Date: 2026-08-13
Package: com.ios.urban-vpn-cyber-security

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS app version 4.3.4 (Build 309) analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors