Mahi Tahi - Scouts Aotearoa Security & Privacy Scorecard

Mahi Tahi - Scouts Aotearoa

What This Means for You

Your device information and crash reports are automatically sent to Microsoft and Google, but the app's privacy disclosure incorrectly states no data is shared with third parties.

Recommendation: Use With Caution

App contains medium-severity security issues and inaccurate privacy disclosures about third-party data sharing. Exercise caution, especially for youth users. Parents and guardians should be aware that the app's stated privacy practices do not fully reflect how data is shared.

Best For: Scout members and administrators who need to access Scouts Aotearoa community features on mobile

Key Findings

Data Security - 2 findings (1 low, 1 info)

Network Security - 1 finding (1 medium)

Code Safety - 2 findings (1 medium, 1 info)

Privacy - 2 findings (2 info)

Privacy Concerns

What Data is Collected

• Personal information: account identity, user ID, organisation ID
• Device information: device model, operating system version, app version
• Usage data: app interactions, crash reports, analytics events
• Location data: approximate and precise location (GPS and network-based)

Third-Party Data Sharing

The following third parties may receive your data:

• Microsoft (App Center) - crash reports, analytics events, device information
• Google (Firebase Messaging) - push notification delivery
• Google (Maps and Location Services) - location data for map features

Understanding the Scores

Security: 92/100
Privacy: 82/100

Security Breakdown

• Data Security: 97/100 - Account data is well protected on-device; a low-severity analytics service identifier is included in the app package
• Network Security: 93/100 - Secure connections are enforced; one medium-severity issue allows unvalidated external navigation from in-app browser contexts
• Code Safety: 92/100 - Strong overall code practices; one medium-severity issue affects how the app verifies the identity of partner app communications

Privacy Breakdown

• Data Collection: 83/100 - Collects location, device, and usage data appropriate to app function
• Data Sharing: 80/100 - Data is shared with Microsoft and Google but the Play Store privacy declaration does not disclose this
• User Control: 84/100 - Limited ability to opt out of analytics or crash reporting within the app

Positive Security Features

• Account data is protected using hardware-backed encryption on supported devices
• Backup protection prevents your account data from being copied via device backup tools
• Secure connection errors are rejected rather than bypassed
• Screen recording and screenshot detection is active in release builds
• Protection against overlay-based tap hijacking is enabled
• User-installed certificates are not trusted for network connections in production builds
• Root and tamper detection is enabled
• No advertising or attribution tracking SDKs are present
• File sharing is correctly restricted to app-private directories
• Remote browser debugging is disabled in production

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Accurate Third-Party Data Sharing Disclosure
   The Play Store Data Safety section states "No data shared with third parties," which does not reflect the actual data flows to Microsoft App Center and Google services. Given the app's youth user base and New Zealand Privacy Act 2020 obligations, accurate disclosure should be a priority.

2. Crash and Analytics Opt-Out
   Providing users with an in-app option to opt out of crash reporting and analytics collection would better align with privacy expectations for a youth-focused platform.

Security Enhancements

1. Partner App Identity Verification
   The mechanism used to verify which partner app is communicating with Mahi Tahi relies on information that any installed app can supply. Using cryptographic signature verification to confirm partner app identity would provide a stronger guarantee.

2. External Navigation Validation
   Links opened from within the app's browser context should be validated before navigating to external destinations, limiting the types of addresses that can be triggered from in-app web content.

Technical Context

App Type: Youth community platform - social, location-enabled, sensitive user base
Classes Analyzed: 15,448
Third-Party Services: 10 (Salesforce Mobile SDK, Salesforce Nimbus, Salesforce Marketing Cloud Push, Microsoft App Center Analytics, Microsoft App Center Crashes, Firebase Messaging, Google ML Kit Barcode, Google Play Services, PaperDB, OkHttp3)
Context Tags: youth, social, location, sensitive_data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: THE SCOUT ASSOCIATION OF NEW ZEALAND
Version: 12.6 (versionCode 120600000, build date 2024-10-07)
Analysis Date: 2026-05-08
Package: com.mysalesforce.mycommunity.C00D2w000004KpHiEAK.A0OT2w000000TN9bGAG

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 12.6 analyzed on 2026-05-08
• May not reflect server-side security controls
• Cannot detect all runtime behaviors