Scan results

Recommendation: Trustworthy

CITT rates X Trustworthy at 82/100. The build incorporates meaningful security foundations: direct message encryption uses XChaCha20-Poly1305, app data is excluded from cloud backup, account sign-in data is stored in Android's OS-level account manager, and domain validation is configured for core streaming connections. The binary also links Google AdMob alongside a Play Store data safety label that declares no third-party data sharing, a point of comparison between the binary evidence and the published disclosure.

Key Findings

Data Security: 1 finding (1 low)

Network Security: 2 findings (1 medium, 1 low)

Code Safety: 6 findings (3 medium, 3 low)

Privacy: 2 findings (1 medium, 1 low)

Privacy Concerns

What Leaves the Device

• Advertising identifier: the binary includes Google AdMob code designed to read the Google Advertising ID and may send ad measurement signals to Google's infrastructure.
• Behavioral and location signals: the Castle Highwind fraud detection SDK in this build registers continuous sensor listeners (accelerometer, gyroscope, location) and may send device signals to Castle's servers.
• Analytics and crash data: the binary includes Google Firebase Analytics and Google Firebase Crashlytics code, which may send usage signals and crash diagnostics to Google's servers.
• Payment and financial data: the binary includes Stripe, Plaid, and Pinwheel integrations for payments and financial account linking, which may process relevant financial information with those services.
• Identity verification data: the binary includes the Socure identity verification SDK, which may send document and identity signals to Socure's servers when identity verification is initiated.

What Stays on the Device

• Camera frames captured during identity document verification are processed using on-device machine learning models; the code does not route intermediate frames off the device.
• The list of installed apps used for the share feature is evaluated on the device; the code does not route this list to remote servers.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google (AdMob, Firebase Analytics, Crashlytics, Cloud Messaging, Maps) - advertising, analytics, crash reporting, notifications, and mapping
• Castle (Highwind SDK) - behavioral fraud detection
• Sardine AI - fraud detection
• Branch.io - app attribution
• Datadog - performance monitoring
• Stripe - payment processing
• Plaid - financial account linking
• Pinwheel - financial data access
• Socure - identity document verification
• Auth0 - authentication services
• LiveKit - live audio and video streaming

Understanding the Scores

Security: 85/100
Privacy: 80/100

Security Breakdown

• Data Security: 83/100. The build links strong cryptographic tools for direct message encryption and stores account sign-in data at the OS level. A low-severity configuration was identified involving media downloads written to a shared storage location that other apps may read on older Android versions.
• Network Security: 87/100. The build's network configuration permits unencrypted HTTP connections app-wide, which means third-party libraries in the build could issue unencrypted requests without being blocked. Core X API connections are directed to encrypted channels.
• Code Safety: 82/100. The build includes several security-oriented components. A debug HTTP inspector library was pulled from a dependency rather than its production no-op form; it is not wired into traffic capture in this build. Several in-app browser components are configured with broad domain patterns that could be tightened.

Privacy Breakdown

• Data Collection: 82/100. The binary links analytics, advertising, and fraud detection services that may send usage signals off the device. Camera frames during identity verification and the installed-app list for sharing are both processed on the device; the code does not route them to remote servers.
• Data Sharing: 86/100. Data sharing is directed primarily toward functional purposes: payments, fraud prevention, push notifications, and attribution. The advertising data flow is limited to the advertising identifier.
• User Control: 85/100. The Play Store lists data deletion as available. The build links account management functionality aligned with that capability.

Positive Security Features

• Direct message encryption uses XChaCha20-Poly1305, the same cryptographic foundation used by Signal and WhatsApp.
• All app data is excluded from cloud backup, so a compromised cloud account cannot retrieve stored messages, sign-in data, or encryption keys.
• Account sign-in data is stored in Android's OS-level account manager rather than application-level storage.
• Domain validation is configured for X and Periscope streaming connections, reducing exposure to rogue certificate attacks.
• The SMS one-time code auto-read feature extracts only the numeric code with no full message body access.
• The build includes multiple layers of tamper detection and integrity checking, including Play Integrity attestation.
• Camera frames processed during identity document capture remain on the device via on-device machine learning models; the code does not route intermediate frames off the device.
• The installed-app list used for the share feature is evaluated on the device; the code does not route this list to remote servers.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Advertising data flow and the Play Store data safety label
   Google's Data Safety policy requires developers to declare data shared with third parties, including advertising SDKs operated by companies other than the developer. The Play Store data safety label for this app (retrieved 2026-08-12) states "No data shared with third parties." The binary links Google AdMob; the AdMob SDK is designed to read the Google Advertising ID and connect to Google's ad measurement infrastructure. Google (which operates AdMob) is a company separate from X Corp. CITT makes no compliance determination; readers can compare the label and the binary evidence above.

2. Castle fraud detection SDK and the Play Store data safety label
   The Castle Highwind SDK is present in the binary and is designed to read device sensor data and location signals and may send those signals to Castle's servers. The Play Store data safety label (retrieved 2026-08-12) does not list Castle as a data recipient. CITT makes no compliance determination; the binary evidence is noted so readers can compare.

Security Enhancements

1. Restrict network connections to encrypted channels
   The build-level network configuration permits unencrypted HTTP app-wide. A network security configuration that restricts connections to HTTPS, with narrowly defined exceptions, would reduce the risk of third-party components making unencrypted requests.

2. Replace the debug HTTP inspector library with its production no-op
   The full debug variant of the Chucker HTTP inspector library was included from a build dependency. Replacing it with the production no-op variant would reduce unnecessary build surface.

3. Scope media downloads to app-private storage
   Downloaded media and direct message attachments are written to the public Downloads folder. On Android 9 and below (this build's minimum supported version), other apps with the shared storage permission may read those files. Writing to app-private storage would prevent that exposure.

Technical Context

App Type: Social media and real-time news platform (Mature 17+, contains ads and in-app purchases)
Classes Analyzed: 189,483
Third-Party Services: 24 identified
Context Tags: social, ads, financial, sensitive_data, location, camera

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: X Corp.
Version: 12.15.2-release.0
Analysis Date: 2026-08-13
Package: com.twitter.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 12.15.2-release.0 analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors