Urban VPN Security & Privacy Scorecard
by Urban Cyber Security INC · iOS
Data collection and sharing practices score poorly, meaning user activity may be tracked and passed to third parties beyond what would be expected from a privacy tool. Network traffic handling has notable gaps for a service built around protection. The level of data gathered about users is high relative to what this type of service needs.
Best for
Occasional VPN use with basic privacy needs
Avoid if
You share sensitive personal or financial data
Findings
- 0 critical
- 5 high
- 6 medium
- 5 low
- 6 info
1 issue identified across security and privacy analysis.
Top security issues
- Branch API secret key (secret_live_* format) embedded in production Info.plist — extractable from any IPA without jailbreak, grants management API access
- App Transport Security globally disabled with NSAllowsArbitraryLoads=true — eliminates HTTPS enforcement for all SDK traffic in a VPN app
- OpenSSL VPN tunnel security level set via dynamic ObjC property rather than hardcoded constant — actual cipher strength unverifiable from static analysis
Top privacy issues
- Advertising conversion SDK (GoogleAdsOnDeviceConversion) embedded in VPN app with explicit 'zero data collection' claims — direct factual contradiction
- All Google Analytics advertising consent signals default to true from first launch with no user consent gate — GDPR violation at scale
- Mixpanel tracks VPN connection events (connect, disconnect, server switches) with persistent device identity, profiling the very privacy behaviors VPN is meant to protect
Full analysis
What This Means for You
Data collection and sharing practices score poorly, meaning user activity may be tracked and passed to third parties beyond what would be expected from a privacy tool. Network traffic handling has notable gaps for a service built around protection. The level of data gathered about users is high relative to what this type of service needs.
Recommendation: Use With Caution
Best For: Occasional VPN use with basic privacy needs
Avoid If: You share sensitive personal or financial data
Key Findings
Data Security - 4 findings (1 medium, 2 low, 1 info)
Network Security - 3 findings (1 high, 2 medium)
Code Safety - 0 findings
Privacy - 5 findings (2 high, 2 medium, 1 info)
Privacy Concerns
What Data is Collected
The app gathers a broad range of information about device and usage patterns. The volume and scope of data collected is high relative to what a service focused on protecting user connections actually needs to function.
Third-Party Data Sharing
No third-party services were identified during analysis.
Understanding the Scores
- Security: 70/100
- Privacy: 30/100
- Data Security: 89/100
- Network Security: 62/100
- Code Safety: 79/100
- Data Collection: 25/100
- Data Sharing: 30/100
- User Control: 40/100
Positive Security Features
- No positive security practices were identified during this analysis.
Areas for Improvement
- The amount of data collected goes well beyond what a basic privacy service requires, leaving more user activity exposed than necessary.
- Connection protection has notable gaps that undermine the core purpose of keeping user traffic private.
- Users have very limited ability to control what data is gathered or how it is used.
About This Analysis
Scores are based on static analysis of the app's code, behavior, and data practices. Higher scores indicate better security and privacy protections.
App Details
- Package ID: com.ios.urban-vpn-cyber-security
- Scan Date: 2026-03-26
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 42/100 |