Scan results

Recommendation: Trustworthy

CITT assessed this build as Trustworthy with an overall score of 83 out of 100. No third-party advertising, attribution, or behavioral tracking SDKs are present in the binary, and camera location data is stored locally without code paths to send it to Reolink's servers. Two high-severity account-handling weaknesses were identified: the in-app browser component returns account session information to page scripts without validating the page's origin, and the sign-in callback handler contains no check for the authenticity of incoming sign-in links before completing a login; both require a network-level attack or a malicious co-installed app to attempt and were not verified at runtime.

Key Findings

Data Security: 1 finding (1 medium)

Network Security: 4 findings (1 high, 3 medium)

Code Safety: 2 findings (1 high, 1 low)

Privacy: 1 finding (1 low)

Privacy Concerns

What Leaves the Device

• Device telemetry (install ID, device model, OS version, locale): the binary contains code configured to send these to Reolink's own servers; certain code paths appear to send operational events without checking the user's opt-in preference, though this was not verified at runtime
• Push notification device identifiers: the binary links Firebase Cloud Messaging; delivering push notifications through this service involves registering a device identifier with Google's servers, though this was not observed at runtime

What Stays on the Device

• Camera location data: the analyzed binary stores camera location on the device and does not contain code paths that send it to Reolink's servers, keeping it within the user's control
• On-device video analysis: the binary links Google ML Kit and ONNX Runtime for local inference; results from these components are processed on the device

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google (Firebase Cloud Messaging) - push notification delivery (device identifier registration for notification routing)

No advertising, data-broker, attribution, or behavioral analytics third parties were identified in the binary.

Understanding the Scores

Security: 78/100
Privacy: 96/100

Security Breakdown

• Data Security: 76/100. The binary initializes its primary key-value store without encryption; on a physically accessed device, this store's contents are directly readable, including the key material used to protect stored camera passwords. All network-transmitted data is protected via HTTPS throughout the analyzed build.

• Network Security: 79/100. The binary uses HTTPS for cloud connections and the network security configuration disables unencrypted traffic. One high-severity issue was identified: the in-app browser component returns account session information to page scripts without validating the page's origin. Three medium-severity issues include an unsanitized callback name in a secondary browser interface, a P2P server list loaded from the network without a domain allowlist, and a bundled networking library version with a known crash issue when handling malformed responses.

• Code Safety: 84/100. The build does not link advertising or tracking libraries, and standard Android security practices are followed throughout most of the codebase. The sign-in callback handler does not verify the authenticity of incoming sign-in links, and a file-sharing component included via an Expo module is accessible to other installed apps without a permission requirement.

Privacy Breakdown

• Data Collection: 94/100. The binary links no advertising, behavioral profiling, or data-broker SDKs. First-party telemetry is scoped to operational data such as device model, OS version, and locale, defaults to off, and requires explicit user opt-in.

• Data Sharing: 100/100. No user data is shared with advertising networks, data brokers, or analytics companies. All telemetry flows go to Reolink's own infrastructure. Firebase Cloud Messaging handles push notification delivery, involving Google receiving a device identifier for notification routing.

• User Control: 91/100. The build provides an explicit opt-in gate for behavioral telemetry, defaulting to off. Account data deletion is supported through Reolink's account management. Camera location data stays on the device without being sent to the developer's servers.

Positive Security Features

• Firebase Analytics is explicitly disabled in the analyzed build; no behavioral data is configured to reach Google through this component
• No advertising, attribution, or data-broker SDKs are present in the binary
• Camera location data is stored on the device; the analyzed binary does not contain code paths that send it to Reolink's servers
• On-device video analysis via Google ML Kit and ONNX Runtime keeps inference results on the device
• All cloud API connections use HTTPS; the network security configuration in the build disables unencrypted connections
• Camera passwords are protected by a per-installation encryption scheme using a randomly generated key created at setup time
• First-party behavioral telemetry requires explicit user opt-in and defaults to off in the analyzed build

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Push notification service and the data safety label
   The Google Play data safety section (retrieved August 11, 2026) states "No data shared with third parties." The binary links Firebase Cloud Messaging, a Google service; push notification delivery through this service involves registering a device identifier with Google's servers. Google Play's data safety guidance defines sharing as data sent to a third party for a purpose other than the core feature; whether push notification token registration falls within that scope is a judgment the developer must make. Whether this service relationship was accounted for in the declaration could not be determined from the binary alone.

2. Telemetry code paths and opt-in scope
   The binary contains a telemetry method that sends operational events to Reolink's servers without checking the user's opt-in preference; three call sites were identified that use this path. The data safety label (retrieved August 11, 2026) states the app "may collect these data types: Location, Personal info, and Messages." Whether the automatic telemetry paths observed in the binary are fully reflected in this declaration could not be determined from static analysis alone.

Security Enhancements

1. In-app browser origin validation
   The in-app browser's account information handler could be improved by adding origin validation before returning account session details to page scripts. Industry best practice recommends verifying that the requesting page's origin matches an expected domain before responding to such requests, which would close the path by which a modified or compromised page could request those details.

2. Sign-in callback authenticity check
   Adding a state parameter generated at login initiation and verified on return would prevent a malicious co-installed app from crafting a sign-in link targeted at this app. Android's App Links standard (requiring domain verification) would also restrict which apps can receive these callbacks.

3. Key-value store encryption
   Enabling encryption on the key-value store used to hold camera password key material would prevent those values from being readable on a physically accessed device. The MMKV library supports an encrypted mode via a cryptographic key parameter at initialization.

Technical Context

App Type: IoT security camera companion - high sensitivity (camera access, account session management)
Classes Analyzed: 3,000
Third-Party Services: 25 identified
Context Tags: camera, iot, location, sensitive_data

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Reolink Innovation Limited
Version: 4.61.0.3.20260721 (Build 780)
Analysis Date: 2026-08-12
Package: com.mcu.reolink

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 4.61.0.3.20260721 analyzed on 2026-08-12
• May not reflect server-side security controls
• Cannot detect all runtime behaviors