Nest Security & Privacy Scorecard
by Nest Labs · iOS
Usage data flows through Firebase, which tracks app performance and supports remote configuration. Apple's ad attribution network can link user activity to advertising campaigns. Data is handled with reasonable care, and sharing with outside parties is limited.
Best for
Smart home control from your phone
Findings
- 0 critical
- 1 high
- 5 medium
- 9 low
- 8 info
1 issue identified across security and privacy analysis.
Top security issues
- Keychain OAuth tokens for home security controls (cameras, locks, alarms) use deprecated kSecAttrAccessibleAlways, making them extractable via unencrypted iTunes/iCloud backup
- No biometric re-authentication required before disarming home alarm or unlocking smart door locks — any active session can trigger high-privilege physical security actions
- TLS bypass mechanism (trustUnsafeCertificates) present in production binaries with Firebase Remote Config integration that could potentially enable it remotely
Top privacy issues
- Home address, name, and email declared linked to identity and used for developer advertising without any identifiable consent mechanism — geofence transitions (daily home/away patterns) uploaded as analytics telemetry
- Analytics SDK auto-initializes at launch via AutoOptInSelectionTracker with no consent dialog identified for advertising data processing of location and identity
- Contacts data declared for analytics collection despite permission rationale stating only emergency contacts and home sharing — raw contacts transit Google DLP API infrastructure
Full analysis
What This Means for You
Usage data flows through Firebase, which tracks app performance and supports remote configuration. Apple's ad attribution network can link user activity to advertising campaigns. Data is handled with reasonable care, and sharing with outside parties is limited.
Recommendation: Acceptable
Best For: Smart home control from your phone
Key Findings
Data Security - 7 findings (2 medium, 3 low, 2 info)
Network Security - 5 findings (1 medium, 1 low, 3 info)
Code Safety - 0 findings
Privacy - 5 findings (1 high, 2 medium, 1 low, 1 info)
Privacy Concerns
What Data is Collected
The app collects device performance metrics, crash reports, and usage analytics through Firebase. Ad attribution services record whether the app was installed through an advertising campaign and can associate user activity with ad networks.
Third-Party Data Sharing
Data is shared with the following third parties:
- Google (Firebase) - Performance monitoring, crash diagnostics, usage analytics, and remote configuration
- Apple Ads Attribution - Links installation and in-app activity to advertising campaigns
- SKAdNetwork - Provides anonymized conversion signals to advertising networks
Understanding the Scores
| Category | Score |
|---|---|
| Security | 80/100 |
| Privacy | 72/100 |
| Data Security | 72/100 |
| Network Security | 92/100 |
| Code Safety | 90/100 |
| Data Collection | 74/100 |
| Data Sharing | 88/100 |
| User Control | 77/100 |
Positive Security Features
- Network communication is secured using well-established protections, keeping data safe in transit
- The app handles user sign-in through a recognized, reputable authentication approach
- Strong code safety practices reduce the risk of common coding mistakes that could expose user data
Areas for Improvement
- Data stored on the device could be better protected against unauthorized access by other apps
- Privacy disclosures have one area of higher concern related to how personal data is categorized and disclosed
- The app could offer users more direct controls over what data is collected and how it is used
About This Analysis
This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observed practices at the time of the scan and may not capture all runtime behaviors.
App Details
| Field | Value |
|---|---|
| Package | com.nestlabs.jasper.release |
| Version | 5.86.3 (Build 5.86.3.0) |
| Scan Date | 2026-03-29 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 74/100 |