El Martillazo Security & Privacy Scorecard
Android
Browsing and shopping activity is tracked by Firebase Analytics and Google Advertising and can be used to target ads. Google Tag Manager is also present, meaning the data collected can be adjusted remotely without a new app release. Two critical data-handling issues were found, and user data may not be fully protected.
Best for
Shoppers comfortable with standard Google analytics
Findings
- 2 critical
- 6 high
- 8 medium
- 6 low
- 11 info
0 issues identified across security and privacy analysis.
Top security issues
- Unencrypted Firebase Authentication Tokens in SharedPreferences
- Unencrypted Firestore Local Cache Exposes Sensitive Auction Data
- Wildcard Origin Access Policy Allows Loading Malicious Content
Top privacy issues
- Pre-Consent Analytics Data Collection (GDPR/CCPA Violation)
- PII in Firebase Crashlytics Reports
- PII in Firebase Performance Monitoring URLs
Full analysis
El Martillazo
What This Means for You
Browsing and shopping activity is tracked by Firebase Analytics and Google Advertising and can be used to target ads. Google Tag Manager is also present, meaning the data collected can be adjusted remotely without a new app release. Two critical data-handling issues were found, and user data may not be fully protected.
Recommendation: Use With Caution
Best For: Shoppers comfortable with standard Google analytics
Key Findings
Data Security - 4 findings (2 critical, 1 medium, 1 low)
Network Security - 2 findings (2 high)
Code Safety - 0 findings
Privacy - 3 findings (2 high, 1 medium)
Privacy Concerns
What Data is Collected
The app collects browsing and shopping behavior, app usage patterns, device identifiers, and performance metrics. Firebase Analytics and Firebase Performance Monitoring record how users interact with the app, while Firebase Crashlytics gathers technical details about the device when the app encounters problems. Google Advertising uses this activity data to build a profile that informs ad targeting.
Third-Party Data Sharing
Activity data is shared across multiple Google-owned services, including Firebase Analytics, Google Advertising, and Google Tag Manager. Google Tag Manager is particularly notable because it allows the developer to change what data is collected without releasing a new version of the app. Firebase Cloud Functions and Firebase Remote Config also send and receive data through Google's infrastructure.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 75/100 |
| Privacy | 80/100 |
| Data Security | 70/100 |
| Network Security | 80/100 |
| Code Safety | 82/100 |
| Data Collection | 85/100 |
| Data Sharing | 85/100 |
| User Control | 82/100 |
Positive Security Features
- No notable positive security practices were identified in this version of the app.
Areas for Improvement
- Protection of sensitive information stored on the device should be strengthened, particularly given the two critical data-handling issues identified.
- Network communications could be better secured, as user data may travel with less protection than expected on public networks.
- More transparent and accessible controls over advertising and behavioral data collection would give users a clearer picture of how their information is used.
About This Analysis
This scorecard is generated from automated static analysis of the app's code and configuration. Scores and findings reflect the state of the app at the time of the scan and may not capture changes introduced in later updates.
App Details
- App: El Martillazo
- Package: com.sivarsas.webiid.elmartillazo
- Version: 1.1.57
- Scan Date: 2026-02-06
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 78/100 |