Scan results

Recommendation: Solid

Build 4.2.91 protects account sign-in data with hardware-backed device security while storing boarding passes, MileagePlus account numbers, and user PINs in a local database without on-device encryption. Analytics and session-recording services are configured to start before a consent gate is active in the app's startup sequence. Suitable for frequent United travelers who prioritize integrated booking, check-in, and inflight services and accept these security tradeoffs.

Key Findings

Data Security: 3 findings (1 high, 2 medium)

Network Security: 2 findings (1 medium, 1 low)

Code Safety: 5 findings (2 medium, 3 low)

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

• Travel booking and account data: sent to United Airlines servers as the core function of flight booking, check-in, and account management
• App usage and behavioral event data: shared with multiple analytics vendors including Quantum Metric, Kochava, Mixpanel, and Snowplow for measurement and attribution
• Session activity recordings: may be shared with Quantum Metric; the SDK is configured to initialize before a user consent prompt is reached, and the SDK's published documentation describes session capture functionality
• Location information: may be shared with Radar.io for airport and trip features when location permission has been granted and an active trip is in progress
• Device identifiers: may be shared with analytics and attribution services as part of event data streams

What Stays on the Device

• Boarding passes: cached locally for offline access during travel
• Flight status, gate information, and connection details: stored on the device for in-trip reference

Third-Party Data Sharing

Third parties that may receive data from the app:

• Quantum Metric - session recording and behavioral analytics
• Kochava - marketing attribution and install measurement
• Google (Firebase) - push notifications and analytics
• Google Mobile Ads - advertising
• Mixpanel - behavioral analytics
• Snowplow - event analytics
• Datadog - app performance monitoring
• Radar.io - location-based airport and trip features
• Netomi - in-app customer support chat
• Qualtrics - in-app surveys and feedback
• Microsoft Azure / Cognitive Services - cloud and voice features
• CardinalCommerce - payment security verification
• Uplift - buy-now-pay-later payment option
• Jumio Netverify - identity verification
• CarTrawler - car rental integration
• Lyft - ground transportation integration
• PingIdentity PingOne - identity and access management

Understanding the Scores

Security: 76/100
Privacy: 74/100

Security Breakdown

• Data Security: 50/100. Build 4.2.91's local database stores boarding passes, MileagePlus account numbers, and user PINs without on-device encryption. An encryption implementation used to protect account profile fields uses a fixed parameter that reduces its effectiveness, and payment card data encryption relies on a remote configuration flag to select the stronger of two available schemes.

• Network Security: 82/100. The build correctly handles connection errors across its backend calls. A configuration exception permits unencrypted connections to seven aircraft inflight entertainment network hosts, including for content licensing key requests on the shared cabin network.

• Code Safety: 85/100. Hardware-backed key storage protects account sign-in data and developer backup access is disabled across 63,786 analyzed classes. Payment return link handlers accept callbacks based on link scheme alone without source verification, and the Chase credit card web screen exposes broader native functionality than the interaction requires, accessible to the web content it displays.

Privacy Breakdown

• Data Collection: 80/100. Core travel data including bookings, check-in information, and bag tracking is gathered as expected for airline app functionality. Multiple concurrent analytics services receive behavioral event streams and usage data.

• Data Sharing: 86/100. Data sharing covers United's airline partners, payment processors, and a named set of analytics and attribution services. No data broker sharing was identified in this build.

• User Control: 80/100. The Google Play listing includes a data deletion request option. Background location access is gated on an explicit system permission grant and an active trip condition in the app's code.

Positive Security Features

• Account sign-in sessions, flight status data, and bag tracking information are protected with hardware-backed encryption that ties the security keys to this specific device
• Developer backup access is disabled, preventing app data from being read through Android's standard backup channels
• Background location access requires an explicit system permission grant and an active trip condition in the app's code; location is not requested during general app browsing based on this build
• Secure connection errors are correctly rejected across the app's backend calls, with no unsafe override patterns found in this build

Areas for Improvement

Disclosure observations

The Google Play Store Data Safety label (retrieved August 2026) declares that the app may share Personal info with third parties and may collect Location, Personal info, and 8 other data categories. Build 4.2.91 links analytics and attribution SDKs including Quantum Metric, Kochava, Mixpanel, Snowplow, and Datadog, each of which may receive independent event streams. Google's Data Safety guidance asks developers to itemize all data flows through bundled third-party libraries; comparing the label against the linked SDKs may reveal areas worth clarifying.

Security Enhancements

1. Local database protection
   The local database holding boarding passes, MileagePlus account numbers, and user PINs could be strengthened by enabling on-device database encryption, which would limit exposure if the device is accessed without authorization.

2. Payment card encryption consistency
   The build defaults to an older padding scheme for payment card data when a remote configuration flag is absent. Using the stronger scheme that the app already applies in other areas as the unconditional default would remove the dependency on runtime flag state.

3. Inflight entertainment connection security
   Build 4.2.91 contains configuration permitting unencrypted connections to seven aircraft network hosts, including for content licensing key requests. Configuring encrypted connections for these hosts would reduce the exposure window on shared cabin Wi-Fi networks.

4. Chase agreement document storage
   Credit card agreement documents written as part of the Chase credit card flow are saved to a storage location readable by other installed apps using standard Android media access. Saving these files to the app's private storage would limit access.

5. Payment return link validation
   The payment return link handlers accept callbacks based on the link scheme alone, without source verification. Adding a state verification step to these handlers would reduce the risk of forged callback invocations.

Technical Context

App Type: Travel and financial (airline booking, payments, inflight services)
Classes Analyzed: 63,786
Third-Party Services: 29 identified
Context Tags: financial, travel, location, ads, sensitive_data

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: United Airlines, Inc.
Version: 4.2.91 (Build 3611)
Analysis Date: 2026-08-13
Package: com.united.mobile.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 4.2.91 analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors