McGraw Hill K-12 Portal Security & Privacy Scorecard

Android

65
Overall trust score
Use With Caution
65
Security
65
Privacy

Usage activity is monitored by Firebase Analytics and New Relic, including session recordings that can capture user interactions. Third-party educational platform SDKs access user content and reading behavior. Data stays largely within the app ecosystem, with limited external sharing beyond crash reporting and analytics.

Best for

Students using assigned digital textbooks

Findings

  • 0 critical
  • 14 high
  • 10 medium
  • 5 low
  • 0 info

6 issues identified across security and privacy analysis.

Top security issues

  • Kitaboo SDK OAuth consumer key and secret hardcoded in APK (base64 only) — enables forged API requests to eBook backend, potentially exposing content for all Hurix platform customers
  • Universal file system access in Hurix WebViews combined with HTTP Kitaboo API creates exploit chain: MITM attacker injects malicious file:// URL to exfiltrate app data directory
  • WebView SSL error handler allows user-bypassed certificate validation, enabling silent MITM on K-12 school networks where students are likely to click 'continue'

Top privacy issues

  • New Relic Session Replay SDK capable of recording K-12 student screens and touch coordinates without consent — remotely activatable by anyone with access to the exposed New Relic license key
  • Advertising SDK permissions (ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_AD_ID) declared in children's app claiming Play Families Policy compliance — likely COPPA and Families Policy violation
  • New Relic APM initializes before Application.onCreate() via ContentProvider, making pre-consent data collection structurally impossible for all users including children under 13

Full analysis

Version: 1.3.2 (build 89)
Scan Date: 2026-04-07
Overall Score: 65/100 (D)

What This Means for You

Usage activity is monitored by Firebase Analytics and New Relic, including session recordings that can capture user interactions. Third-party educational platform SDKs access user content and reading behavior. Data stays largely within the app ecosystem, with limited external sharing beyond crash reporting and analytics.

Recommendation: Use With Caution

Best For: Students using assigned digital textbooks

Key Findings

Data Security - 10 findings (2 high, 4 medium, 1 low, 3 info)

Network Security - 4 findings (3 high, 1 medium)

Code Safety - 0 findings

Privacy - 8 findings (2 high, 1 medium, 3 low, 2 info)

Privacy Concerns

What Data is Collected

Firebase Analytics collects session activity, screen views, and usage patterns each time the app is opened. New Relic Mobile APM collects performance data and, through its Session Replay feature, can record on-screen interactions in detail. The Hurix Kitaboo, MHE ePubReader, and Avalon Assessment SDKs access user reading progress, content interactions, and assessment responses within the app.

Third-Party Data Sharing

Data flows to Firebase services (operated by Google) for analytics, crash reporting, push notifications, and remote configuration. New Relic receives app performance metrics along with session recordings of user interactions. Educational content platform SDKs may transmit user usage and assessment data to their respective backend systems. No advertising networks were detected, so user data is not shared with ad targeting companies.

Understanding the Scores

Category Score
Security 65/100
Privacy 65/100
Data Security 70/100
Network Security 63/100
Code Safety 75/100
Data Collection 70/100
Data Sharing 90/100
User Control 77/100

Positive Security Features

  • No advertising or marketing networks are present, which limits external data sharing and contributes to the strong Data Sharing score of 90/100.
  • Google Sign-In is used for authentication, providing a well-maintained and broadly supported login path.

Areas for Improvement

  • Network communication settings allow connections with less protection than expected, meaning user data may not be fully protected when the app is used on public Wi-Fi, such as at a school, library, or cafe.
  • New Relic Session Replay can record on-screen interactions without a visible in-app control for users to limit or stop that recording.
  • Data stored locally on the device has room for stronger protection against access by other apps installed on the same device.

About This Analysis

This scorecard is based on automated static analysis of the published app binary. Scores reflect the security and privacy posture of the version analyzed and may change in future updates.

App Details

  • Package: com.mheducation.learningtools.k12
  • Version: 1.3.2 (build 89)
  • Analyzed: 2026-04-07
  • Platform: Android

Versions & scan history

ScanDateOverall score
#1 (current) 65/100