Scan results

Recommendation: Trustworthy

CITT assesses this build Trustworthy for professional users. The binary links strong encryption for all LinkedIn API traffic, stores login credentials in the most secure iOS Keychain protection class, and implements Apple App Attest for server-side integrity verification. Contact data sharing for connection suggestions is disclosed in the permission request, and users who decline the contact permission are not affected by that disclosure.

Key Findings

Data Security: 0 findings

Network Security: 3 findings (3 medium)

Code Safety: 3 findings (3 low)

Privacy: 1 finding (1 low)

Privacy Concerns

What Leaves the Device

• Contact data (name, email, phone, employer, postal address, social profiles, and instant-message handles): sent to LinkedIn's servers when contact sync is enabled, per this build's stated permission disclosure
• Attribution signals may be shared with Singular for install and campaign measurement, based on the attribution service linked in the binary
• Crash and diagnostic data may be sent to Crashlytics (Firebase), which is linked in the binary

What Stays on the Device

No sensitive data was identified as processed only on the device.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Singular - install attribution and campaign measurement
• Apple AdServices - attribution for App Store ad campaigns
• Apple AdSupport - advertising identifier framework linked in the binary
• Crashlytics (Firebase) - crash reporting and diagnostics
• Firebase App Check - app integrity verification
• Qualtrics XM - in-app user research and surveys
• Microsoft (AzureCommunicationCalling, WalletLibrary) - video calling and digital identity verification
• Persona2 - identity verification
• Google (Sign-In, GoogleUtilities) - authentication and single sign-on

Understanding the Scores

Security: 84/100
Privacy: 86/100

Security Breakdown

• Data Security: 91/100. Login credentials are stored in the most secure iOS Keychain protection class, tied to the device and requiring the device passcode. Apple App Attest is implemented, allowing servers to verify the binary is genuine before permitting sensitive operations.
• Network Security: 76/100. LinkedIn API traffic uses HTTPS throughout the binary. The transport security configuration permits unencrypted connections across the entire app without per-domain restrictions, which may affect in-app browser flows including identity verification and offsite job applications.
• Code Safety: 95/100. Strong implementation practices are present throughout the binary. Cryptographic operations rely on Apple's built-in security libraries with no custom implementations found.

Privacy Breakdown

• Data Collection: 86/100. Contact sync is explicitly disclosed in this build's permission request. The binary links contact field keys for postal addresses, social profiles, and instant-message handles in addition to name, email, and phone.
• Data Sharing: 91/100. Attribution and identifier sharing is standard for an App Store application. No external consumer advertising network SDK is present in this build; advertising infrastructure is LinkedIn's own.
• User Control: 88/100. Face ID biometric lock is available for an additional account access protection layer. Contact sync is permission-gated, and users who decline the permission are not affected by the contact upload disclosure.

Positive Security Features

• LinkedIn API traffic uses HTTPS throughout the binary; no cleartext first-party connections were found.
• Login credentials are stored using the most secure iOS Keychain protection class, requiring the device passcode and tied to this device only.
• Apple App Attest is implemented, allowing servers to verify the app binary is genuine before permitting sensitive operations.
• Strong encryption is implemented using Apple's built-in security libraries with no custom cryptographic implementations found in the binary.
• Face ID biometric app lock is available for an additional account access protection layer.
• No external consumer advertising network SDK is present in this build; advertising infrastructure is LinkedIn's own.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Transport Security Scope
   Apple's App Transport Security documentation recommends scoping any exceptions to the specific domains that require them. Info.plist in this build sets a global unrestricted transport configuration with no per-domain exceptions, removing enforcement across the entire app including in-app browser flows. Whether server-side redirect controls or other mitigations compensate for this was not tested.

2. Contact Field Breadth
   The permission request in this build states that contacts are uploaded to LinkedIn's servers for connection suggestions. The binary links contact field keys for postal addresses, social profiles, and instant-message handles beyond name, email, and phone. Whether this extended scope is reflected in the App Store privacy label could not be determined from the binary alone.

3. App Privacy Manifest
   Apple's guidance recommends including an app privacy manifest to document data types and system API usage. The main binary in this build does not include one. Adding it could make the App Store privacy label more complete. This is an optional enhancement.

Security Enhancements

1. Per-Domain Transport Security Scoping
   Adding per-domain exception entries for the specific third-party services that require unencrypted connections would reduce the surface area for content injection into in-app browser flows.

2. Origin Validation for In-App Browser Message Handlers
   The identity-verification in-app browser in this build processes JavaScript messages from third-party providers. Adding validation of the originating page's security origin before dispatching those messages would reduce the risk of injected content triggering internal navigation.

Technical Context

App Type: Professional networking - high sensitivity (contacts, identity verification, career data)
Classes Analyzed: 12
Third-Party Services: 20
Context Tags: social, contacts, ads, sensitive_data, camera

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: LinkedIn Corporation
Version: 2026.0805.1140 (Build 9.32.2755)
Analysis Date: 2026-08-13
Package: com.linkedin.LinkedIn

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS binary version 2026.0805.1140 analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors