CITT

    Scan results

    Reddit

    Android

    Reddit is the largest social network where communities discuss topics from news and entertainment to gaming and advice. With 100M+ downloads, the app provides access to over 100,000 forums, AMAs with celebrities, memes, and anonymous discussions. Contains ads and in-app purchases.

    CITT SCORE
    75
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Active Reddit users comfortable with standard analytics

    What It Means For You

    User activity, posts viewed, and interactions are tracked across sessions for analytics. Crash reports and device data are sent to Google. An attribution service records how the user found the app and links in-app behavior back to referral sources.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (21)

    Data Security

    4 total
    2 Critical
    2 Medium

    Network Security

    3 total
    1 Critical
    1 High
    1 Info

    Code Security

    6 total
    4 High
    1 Medium
    1 Info

    Privacy

    8 total
    1 Critical
    3 High
    3 Medium
    1 Info

    Third-Party Services

    Google Firebase, Firebase Crashlytics, Firebase Cloud Messaging, Google Play Services, Branch.io, Matrix SDK, Apollo GraphQL, Glide, ExoPlayer, OkHttp3, Google Tink, Bouncy Castle, Kethereum

    Security Strengths

    • ✓EncryptedSharedPreferences properly implemented with AES-256-GCM and StrongBox
    • ✓Production build not debuggable with code obfuscation (4,022 obfuscated classes)
    • ✓Play Integrity API implemented for device attestation
    • ✓Proper SSL certificate validation with no bypass mechanisms
    • ✓Token validity checking with automatic refresh
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    social
    sensitive data
    location
    ads
    financial
    contacts

    Package

    com.reddit.frontpage

    Version

    2025.46.0 (Build 2546031)

    Analysis Date

    Jan 20, 2026

    Classes Analyzed

    86,206

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 4 findings (2 critical, 2 medium)

    Network Security - 3 findings (1 critical, 1 high, 1 info)

    Code Safety - 0 findings

    Privacy - 8 findings (1 critical, 3 high, 3 medium, 1 info)

    Privacy Concerns

    What Data is Collected

    Reddit collects user browsing activity, posts viewed, votes, comments, and session interactions. Device information and diagnostic data are captured through Google Firebase and Crashlytics. Branch.io records how the user discovered or was referred to the app and ties that back to in-app behavior.

    Third-Party Data Sharing

    Data is shared with the following services:

    • Google Firebase and Crashlytics - Receives device diagnostics, crash reports, and app usage data
    • Google Play Services - Handles platform-level integration
    • Branch.io - Receives attribution and referral data linked to user behavior
    • Firebase Cloud Messaging - Delivers push notifications on Google infrastructure

    Understanding the Scores

    CategoryScore
    Security78/100
    Privacy72/100
    Data Security70/100
    Network Security80/100
    Code Safety82/100
    Data Collection75/100
    Data Sharing80/100
    User Control70/100

    Positive Security Features

    • Standard Android platform security libraries are used for data handling.

    Areas for Improvement

    • Data stored on the device could be better protected to reduce exposure if the device is lost or accessed by someone else.
    • The volume of behavioral data shared with advertising and attribution services could be reduced.
    • Options to control or opt out of third-party data collection within the app are limited.

    About This Analysis

    This scorecard reflects findings from automated static analysis of the app binary and configuration. Results are based on code observable at the time of the scan and may not reflect server-side behavior or recent updates.

    App Details

    • App: Reddit
    • Package: com.reddit.frontpage
    • Version: 2025.46.0 (Build 2546031)
    • Scan Date: 2026-01-20

    Right of Reply

    Developer not yet contacted