MONA Security & Privacy Scorecard

MONA

Experience Mona's world of fashion through an interactive mobile app. Browse products, manage orders, track your loyalty program, create wishlists, find stores, and stay updated on launches and exclusive collaborations.

Quick Assessment

5 security concerns requiring attention

The app has a serious credential exposure issue: a backend authentication token is embedded directly in the publicly downloadable app, potentially allowing unauthorized access to backend systems. Several additional concerns around data storage protection and inaccurate privacy declarations also require attention.

What This Means for You

Primary Concern: A long-lived backend authentication credential is embedded in the public app, meaning anyone who downloads and inspects the APK can extract it and use it to interact with the app's backend systems.

Risk-Based Impact:

• High Risk: The exposed credential could allow unauthorized parties to obtain access tokens for the app's backend API — potentially enabling access to customer authentication workflows or backend operations. This is a server-side risk affecting all users, not just those who take any specific action.

• Medium Risk: Your login session token and shopping cart data are stored on your device without encryption. On a device with developer options enabled, a physically present person could potentially extract these tokens. This is unlikely for typical users on normal, unmodified devices.

• Medium Risk: The app's Play Store privacy declaration states "No data shared with third parties," which is inaccurate. Your data is actively sent to at least four external services. This affects your ability to make informed decisions about using the app.

Recommendation: Use With Caution

The app contains a significant security issue that requires the developer's immediate attention: a backend credential exposed in the public APK is a server-side risk that affects all users regardless of how they use the app. Additionally, session tokens stored without full encryption and an inaccurate privacy declaration reduce overall trust. For casual fashion browsing and loyalty tracking, the risk to individual users is manageable, but the underlying credential issue should be resolved before the app handles any sensitive data.

Best For: Casual shoppers in Serbia comfortable with standard e-commerce data practices who are primarily browsing products, checking order status, or using the loyalty program.

Avoid If: You are privacy-conscious, concerned about data being shared with undisclosed third parties, or expect your shopping credentials to be protected with the highest security standards.

Key Findings

High Security Risks (1 issue)

1. Exposed Backend Credential in Public App ❗
   A long-lived authentication token used to access the app's backend API is embedded directly in the app's code. Since the app is publicly available on Google Play, this credential can be extracted by anyone who downloads and inspects the app. The token is configured to remain valid for approximately 100 years.

   At Risk:

   • Backend API access
   • Customer authentication workflows
   • Server-side operations tied to the exposed account

Medium Security Risks (4 issues)

1. Login Session Tokens Not Fully Protected ⚠️
   Your authentication token, shopping token, and cart information are stored in a standard storage area without additional encryption. While this area is private to the app under normal circumstances, on a device with developer options enabled or with physical access, the stored values could be read without specialized knowledge.

   Note: This requires physical access to your device or developer tools to be enabled. Most users on standard, unmodified devices are not directly affected in day-to-day use.

2. Unencrypted Network Connections Permitted ⚠️
   The app is configured to allow unencrypted HTTP connections without restriction. While the app's own servers appear to use secure connections, this permissive setting means any third-party library or plugin included in the app could potentially make unencrypted requests without restriction.

3. Inaccurate Data Sharing Disclosure ⚠️
   The app's Play Store listing declares "No data shared with third parties." However, the app actively sends data to at least four external services: a personalization platform (Segmentify), an email marketing service (Klaviyo), an IP-based location service (GeoJS), and Google Tag Manager. This discrepancy means users cannot accurately assess the app's data sharing practices from the Play Store listing alone.

4. Third-Party Scripts Can Access Session Cookies ⚠️
   Third-party scripts loaded by the app — including analytics and personalization services — have the technical ability to read and write session cookies through a shared interface. If any of these third-party scripts were ever tampered with (e.g., through a supply chain incident), an attacker could access your session cookies.

   This applies if: You are logged in and a third-party service used by the app were to be compromised.

   For most users: In normal circumstances with uncompromised third-party services, this does not directly affect you.

Low Priority Items (4 issues)

1. Device Backup May Include Login Tokens
   The app is configured to allow Android's backup system to copy app data, including stored login tokens. If someone with physical access to your device runs a backup via developer tools, your session tokens could be included. Disabling USB debugging in developer options mitigates this risk.

2. Third-Party Analytics Script Not Integrity-Verified
   An external personalization script loaded by the app does not include a verification checksum. Without this check, the app cannot confirm the script hasn't been altered between the provider's server and your device. A compromise of the third-party CDN hosting this script could affect in-app behavior.

3. IP Address Sent to External Service on Launch
   When the app first launches and has no stored location preference, it automatically sends your device's IP address to an external geolocation service (GeoJS) to determine your country. This happens silently before any user interaction, without disclosure.

4. Push Notification Service Loads External Code Without Validation
   The app's push notification component can load external scripts from a configurable URL without verifying the URL is from an expected source. Exploitation would require controlling the URL parameter when the notification service is registered, which is not trivially achievable by a remote attacker.

Privacy Concerns

What Data is Collected

• Personal information: email address, name, phone number, customer ID
• Financial information: purchase history, cart contents, payment details (processed via third-party payment providers)
• Device information: device type, IP address, operating system
• Usage data: product views, cart interactions, page navigation, loyalty program activity
• Location data: approximate location (used only for career application form country auto-detection)

Third-Party Data Sharing

The app's Play Store declaration states no data is shared with third parties; however, code analysis identified the following services actively receiving user data:

The following third parties may receive your data:

• Google Tag Manager — Receives your customer ID, currency, language preference, and page navigation events on every screen view. May forward data to additional downstream advertising or analytics tags configured by MONA.
• Segmentify — Receives cart interactions and product views for personalization and recommendations
• Klaviyo — Receives your email address when you subscribe to back-in-stock notifications
• GeoJS — Receives your device's IP address on first app launch to determine your country
• Google reCAPTCHA — Receives browser interaction patterns and device fingerprint for bot detection
• Payment processors — Stripe, Checkout.com, Mollie, BlueSnap, Klarna, PayPal, Google Pay, and others may receive payment information depending on your chosen payment method

Understanding the Scores

Security: 75/100
Privacy: 83/100

Security Breakdown

• Data Security: 89/100 — Most data handling is reasonable, though session tokens could benefit from encrypted storage
• Network Security: 93/100 — Production API calls use secure connections, though the app-level configuration permits unencrypted traffic
• Code Safety: 80/100 — Code quality is generally acceptable, but the hardcoded credential represents a significant lapse

Privacy Breakdown

• Data Collection: 88/100 — Data collected is largely proportionate to the e-commerce use case
• Data Sharing: 87/100 — Several third-party services receive data, but the inaccurate Play Store declaration is a notable concern
• User Control: 88/100 — Users can request data deletion; standard e-commerce privacy controls are present

Positive Security Features

• ✓ Production API communication uses HTTPS, protecting data in transit between your device and MONA's servers
• ✓ Google reCAPTCHA is integrated to protect against automated account abuse and bot activity
• ✓ Payment processing is delegated to established, PCI-compliant payment providers (Stripe, Checkout.com, Klarna, PayPal, and others), meaning payment card data is not handled directly by the app
• ✓ Location permissions are used only for a specific functional purpose (pre-filling country in a job application form) and are not used for advertising or tracking
• ✓ The app declares support for user data deletion requests, providing a baseline level of user control over personal data

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Accurate Third-Party Data Sharing Disclosure
   Update the Play Store Data Safety declaration to accurately reflect data sharing with Segmentify, Klaviyo, GeoJS, and Google Tag Manager. Accurate disclosure is a baseline requirement under GDPR for EU/EEA users and builds user trust.

2. User Notice for Automatic IP Geolocation
   Disclose in the privacy policy that an IP-based geolocation lookup is performed on first launch. Consider delaying this request until the user has had an opportunity to review the app's data practices.

3. Google Tag Manager Governance
   Establish a documented process for reviewing additions to the Google Tag Manager container, since new tracking tags can be deployed without an app update or user disclosure.

Security Enhancements

1. Remove Hardcoded Backend Credentials
   Backend authentication tokens should not be included in the distributed app package. Consider using short-lived, app-attestation-based token exchange mechanisms so that no long-lived credential needs to be embedded in the client.

2. Encrypted Session Token Storage
   Migrate authentication tokens and cart data to an encrypted storage solution, so that session data cannot be read in plaintext even if the device's storage is accessed.

3. Restrict Network Traffic Configuration
   Apply a network security configuration that explicitly limits which domains may use unencrypted connections, rather than permitting cleartext traffic globally.

Technical Context

App Type: Fashion E-Commerce (Shopping, Loyalty, Payments)
Classes Analyzed: 120
Third-Party Services: 21 identified (5 receiving behavioral/personal data)
Context Tags: E-Commerce, Financial, Location, Analytics, Sensitive Data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Mona Fashion d.o.o.
Version: 1.9.64 (versionCode 158)
Analysis Date: April 9, 2026
Package: com.monaonline

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.9.64 analyzed on April 9, 2026
• May not reflect server-side security controls
• Cannot detect all runtime behaviors

For questions about this analysis, contact [email protected].