X Security & Privacy Scorecard
Android
Activity is tracked by Firebase, Google Analytics, and Datadog, and shared with multiple third parties. Financial and identity verification services like Stripe, Plaid, and Socure are embedded, meaning sensitive data entered can flow to outside companies. Behavioral data is collected continuously to build a profile used for targeting.
Best for
Heavy X users comfortable with broad data collection
Findings
- 0 critical
- 0 high
- 0 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Unencrypted SQLite Databases Storing Sensitive User Data
- OAuth Tokens and Session Cookies Stored in Plaintext SharedPreferences
- JavaScript Interface Exposing Payment Processing to XSS Attacks
Top privacy issues
- Analytics and Tracking Initialization Before User Consent
- PII Collection in Analytics Without Redaction
- Third-Party Data Sharing Contradicts Privacy Claims
Full analysis
X
Security Score: 45/100 | Privacy Score: 50/100
Version 11.63.1-release.0 | Analyzed February 7, 2026
What This Means for You
Activity is tracked by Firebase, Google Analytics, and Datadog, and shared with multiple third parties. Financial and identity verification services like Stripe, Plaid, and Socure are embedded, meaning sensitive data entered can flow to outside companies. Behavioral data is collected continuously to build a profile used for targeting.
Recommendation: Use With Caution
Best For: Heavy X users comfortable with broad data collection
Key Findings
Data Security - 4 findings (3 critical, 1 low)
Network Security - 3 findings (1 critical, 1 medium, 1 low)
Code Safety - 0 findings
Privacy - 3 findings (1 critical, 2 high)
Privacy Concerns
What Data is Collected
X collects behavioral data, device identifiers, location signals, and usage patterns. Financial data flows through Stripe and Plaid when payment features are used. Identity documents submitted for verification are processed by Socure DocV.
Third-Party Data Sharing
Data is shared with Firebase Analytics, Google Analytics, and Datadog for analytics and monitoring. ScribeUp, Periscope, and Juicebox also receive data about user activity. Stripe and Plaid receive financial information when payment features are used. Auth0 manages the sign-in process.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 50/100 |
| Data Security | 30/100 |
| Network Security | 75/100 |
| Code Safety | 50/100 |
| Data Collection | 55/100 |
| Data Sharing | 60/100 |
| User Control | 65/100 |
Positive Security Features
- No positive security practices were identified in this analysis.
Areas for Improvement
- How personal data is stored and protected on the device needs significant attention, as current practices create meaningful risk to user information.
- The broad range of third-party services with access to user data increases the likelihood that information is used beyond user expectations.
- Stronger user controls over data collection would provide more meaningful say over what is shared and with whom.
About This Analysis
This scorecard reflects static analysis of the app binary and code at the time of the scan. Results are based on observable behaviors and do not constitute a full security audit.
App Details
- App: X
- Package ID: com.twitter.android
- Version: 11.63.1-release.0 (311620000)
- Scan Date: February 7, 2026
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #2 (current) | 48/100 |