Scan results

Recommendation: Solid

CITT rates this build 76/100 (Solid). The local device control path uses ephemeral session key negotiation between the phone and smart home devices, providing forward secrecy per session, and the build contains no advertising networks or data-broker SDKs. The WiFi password provisioning path relies on a fixed-pattern encryption scheme, and in-app content viewers are configured with unrestricted JavaScript file access that, combined with globally permitted cleartext HTTP, may allow a network adversary who intercepts CDN content to read locally stored account data.

Key Findings

Data Security: 4 findings (1 high, 1 medium, 2 low)

Network Security: 3 findings (2 medium, 1 low)

Code Safety: 2 findings (1 high, 1 low)

Privacy: 2 findings (1 medium, 1 low)

Privacy Concerns

What Leaves the Device

• Meross account identifier, device model, Android version, and app version: bundled into diagnostic error event parameters configured to reach Firebase Analytics when region-code or in-app browser errors occur (runtime delivery was not observed)
• Crash and stability data: shared with Firebase Crashlytics
• User files: may be stored in Amazon S3 via AWS Amplify; server-side access configuration could not be determined from the build

What Stays on the Device

• WiFi network passwords: stored on the device for use in smart home device provisioning on the local network; no code path identified in the build routes these to remote servers, so they remain within the home environment
• Smart home command and automation data: the build includes a local network control path that operates on the home LAN using direct device-to-device communication

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google Firebase (Analytics, Crashlytics, Cloud Messaging) - Diagnostic events, crash reporting, and push notifications
• Amazon Web Services (Cognito, S3) - Cloud storage for user-generated content
• Google Maps - Mapping and location display features
• Google Play Billing - In-app purchase processing
• Google Sign-In - Account authentication option

Understanding the Scores

Security: 73/100
Privacy: 83/100

Security Breakdown

• Data Security: 74/100. The build includes two encryption utilities with fixed initialization vectors used in the WiFi password storage and device provisioning paths, reducing the protection strength of those operations. Account sign-in data is stored without encryption in device preferences, and verbose debug output is enabled in the production build.

• Network Security: 82/100. Cloud API communication appears to use HTTPS. The network security configuration permits cleartext HTTP across the board, covering both the local-network device provisioning path and external CDN content delivery. The Alexa and Google Smart Home OAuth callback path uses an HTTP scheme without app ownership verification rather than a verified HTTPS scheme.

• Code Safety: 82/100. The local device session protocol uses ephemeral key negotiation, providing forward secrecy for each control session. Three in-app content viewers in the build are configured with unrestricted cross-origin file access and JavaScript enabled alongside mixed HTTP/HTTPS content loading. An adversary who intercepts the CDN delivery path may be able to use these settings to read locally stored account data.

Privacy Breakdown

• Data Collection: 86/100. The build links Firebase Analytics and Firebase Crashlytics, with the Meross account identifier included in diagnostic error event parameters. No advertising or behavioral-profiling SDKs were identified in the build.

• Data Sharing: 92/100. Identified data flows in this build target Meross's own infrastructure, Google Firebase services, and Amazon Web Services. The build contains no data-broker or advertising-network SDKs.

• User Control: 85/100. The build supports Google Sign-In and standard Meross account management. The in-app content viewers are configured to grant geolocation access to loaded web content without a visible user prompt, based on the code configuration reviewed.

Positive Security Features

• The local device control session protocol uses ephemeral key negotiation, providing forward secrecy per session for communication between the phone and smart home devices
• The build contains no advertising networks, data brokers, or behavioral-profiling SDKs
• Identified data flows go to Meross's own servers and Google/Amazon infrastructure, with no third-party data-monetization services present in the build

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against published guidance so a reader can compare:

1. Google Play Data Safety section
   Google Play's Data Safety guidelines ask developers to declare which data types leave the device and for what purpose. The Data Safety section for this app, as retrieved on 2026-08-16, was empty. The build links Firebase Analytics and Crashlytics and includes the account identifier in diagnostic event parameters. Whether these data flows are declared could not be confirmed from the build alone; readers can compare the published Data Safety requirements against the store listing.

2. Account identifier in diagnostic analytics events
   Google Play's Data Safety guidelines ask developers to disclose when persistent identifiers are included in data shared with analytics services. The build includes the Meross account identifier in Firebase Analytics event parameters for two defined error conditions. Whether this practice is reflected in the app's store listing disclosures could not be determined from the build.

Security Enhancements

1. WiFi password encryption
   Migrating from static initialization vectors to randomly generated per-operation values in the WiFi password storage and provisioning paths would strengthen the protection for those data flows.

2. In-app content viewer file access
   Disabling cross-origin file access in the in-app content viewers and scoping the cleartext HTTP permission to only the local-network device provisioning addresses would reduce the risk posed by a network adversary on the CDN delivery path.

3. Backup configuration
   Adding data-exclusion rules to the backup configuration would prevent account sign-in data stored in device preferences from being included in Android device backups by default.

4. OAuth callback scheme
   Migrating the Alexa and Google Smart Home OAuth callback links to HTTPS and enabling app ownership verification would ensure callback parameters are delivered only to the Meross app on Android 12 and later devices.

Technical Context

App Type: Smart home controller and IoT device management
Classes Analyzed: 21,091
Third-Party Services: 22
Context Tags: smart_home, iot, location, sensitive_data

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Meross Technology Co. Ltd.
Version: 3.41.1 (Build 1025)
Analysis Date: 2026-08-16
Package: com.meross.meross

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 3.41.1 analyzed on 2026-08-16
• May not reflect server-side security controls
• Cannot detect all runtime behaviors