Scan results

Recommendation: Use With Caution

Build 26.14.0 delivers genuine on-device protection through malware scanning, scam call filtering, Wi-Fi threat detection, and dark web monitoring. The same build links Singular attribution and Adobe AEP Analytics, passing Norton account user ID to those services on app start based on code paths in this analysis, while the Play Store label at the time of analysis declared no third-party data sharing occurs. The build's network configuration also globally permits unencrypted HTTP for traffic outside Norton and Symantec domains, which was not runtime-tested but may affect how third-party SDK traffic travels.

Key Findings

Data Security - 0 findings

Network Security - 2 findings (2 medium)

Code Safety - 7 findings (1 critical, 1 high, 4 medium, 1 low)

Privacy - 3 findings (2 high, 1 low)

Privacy Concerns

What Leaves the Device

• Norton account user ID and advertising identifiers (Google Advertising ID, Android ID, App Set ID): the build initializes Singular attribution on startup with these identifiers, based on code paths found in this analysis; runtime transmission was not observed.
• Product usage events: the build links Adobe AEP Analytics and routes events to Adobe's infrastructure; the specific data included in those events could not be confirmed from the binary without runtime testing.
• Device session identifiers: the build links Avast Burger Analytics and Avast Shepherd Telemetry; what is included in payloads to those services could not be confirmed from the binary without runtime testing.

What Stays on the Device

• Installed application list: the build reads the full list of installed apps on the device for malware scanning and device integrity checks. No remote transmission of this list was found in the analyzed build; processing appears on-device only.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Singular - attribution and install analytics
• Adobe AEP Analytics - product usage and event analytics
• Firebase Analytics / Firebase Crashlytics / Firebase Performance - app analytics and stability reporting
• Avast Burger Analytics - device session analytics
• Avast Shepherd Telemetry - product event telemetry
• Hiya - caller identification and spam call detection
• Stripe - in-app payment processing
• Plaid - bank account linking for financial monitoring
• Auth0 - authentication infrastructure
• Google Play Billing - in-app purchase processing

Understanding the Scores

Security: 65/100
Privacy: 73/100

Security Breakdown

• Data Security: 89/100. Account data and session information are stored in hardware-backed encrypted storage across the build. Backup paths are excluded from the build, preventing stored data from being extracted via Android backup mechanisms.
• Network Security: 78/100. First-party Norton and Symantec domains are configured for HTTPS-only connections. The build's global network configuration permits unencrypted HTTP for all other traffic, which was not runtime-tested.
• Code Safety: 74/100. The build contains a static signing key embedded in a configuration file used to authenticate requests to the Norton login API, and includes several broadly accessible exported components. Standard input handling and memory safety practices are in place across the rest of the build.

Privacy Breakdown

• Data Collection: 71/100. The build requests broad device permissions including contacts, SMS, call log, location, and camera. The installed application list is read on-device for malware scanning, with no evidence of remote transmission found in this analysis.
• Data Sharing: 75/100. Multiple analytics and telemetry services are linked in the binary. The Play Store data safety label at the time of analysis stated no third-party data sharing, which differs from the SDK links found in the build.
• User Control: 76/100. Account deletion and subscription management are available via Google Play. Data-sharing preferences within the build could not be fully assessed from static analysis alone.

Positive Security Features

• Account data and session information are stored in hardware-backed encrypted storage, unavailable to other apps and to backup systems.
• Device backup is disabled across the full build, preventing extraction of stored data via Android backup or Google Cloud Backup.
• VPN login data is stored in a separate hardware-backed encrypted store with its own protected master key.
• Wi-Fi security scanning validates network certificates against the device's trusted certificate store, providing a genuine basis for detecting insecure or tampered network connections.
• The installed application list is processed entirely on the device for malware scanning; no evidence of remote transmission of this list was found in the analyzed build.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Third-party data sharing disclosure
   The Play Store data safety label at the time of analysis (retrieved August 2026) stated "No data shared with third parties." The analyzed build links Singular, Adobe AEP Analytics, Avast Burger Analytics, and Avast Shepherd Telemetry, each initialized with device or account identifiers based on code paths in this build. Google Play's developer guidance defines data sharing as transmitting user data to a third party for the third party's own purposes, with exceptions for service providers acting on the developer's behalf. Whether those flows occur in practice, and whether the developer's categorization of these SDKs falls within the service-provider exception, could not be determined from the binary alone.

2. Transit encryption disclosure
   The Play Store data safety label at the time of analysis stated "Data is encrypted in transit." The build's network security configuration globally permits unencrypted HTTP for all traffic outside Norton and Symantec domains. Whether unencrypted connections are made at runtime could not be determined from the binary.

Security Enhancements

1. Authentication signing key management
   The build embeds a static signing key in an assets configuration file used to generate authentication signatures for the Norton login API. Managing this key outside the app binary, for example via a server-side signing proxy or hardware-attested key issuance, would prevent it from being extracted from the build.

2. Financial flow access restriction
   The bank account-linking activity accepts incoming navigation without verifying the triggering app's identity via Android App Links. Adding App Link verification would restrict which apps may trigger the authenticated bank account-linking flow.

3. Production build cleanup
   The production build includes development and testing framework components that have no user-facing purpose. Excluding these from the release build would reduce unnecessary exposed surface area.

4. Purchase interface origin validation
   The in-app purchase interface uses an unanchored domain pattern for its origin check. A fully anchored pattern would more precisely restrict which pages may interact with the purchase interface.

Technical Context

App Type: Mobile security and identity protection
Classes Analyzed: 39,600
Third-Party Services: 21
Context Tags: security, financial, sensitive_data, ads, contacts

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Gen Digital Inc.
Version: 26.14.0.260729697
Analysis Date: 2026-08-12
Package: com.symantec.mobilesecurity

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 26.14.0.260729697 analyzed on 2026-08-12
• May not reflect server-side security controls
• Cannot detect all runtime behaviors