CITT

    Scan results

    Cayetano

    Android

    Cayetano is a university app providing academic and financial functionalities for students and teachers at Universidad Peruana Cayetano Heredia. Features include course enrollment, grades, schedules, syllabus, payments with Pay-me gateway, electronic tickets, and digital photo verification.

    CITT SCORE
    52
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: UPCH patients comfortable with Google and Mixpanel analytics

    What It Means For You

    User activity is tracked by Firebase Analytics, Google Measurement, and Mixpanel. Payments are processed through Alignet, Mastercard, and Visa SDKs. Data protection practices leave stored information with less protection than expected.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (11)

    Data Security

    5 total
    2 Critical
    3 Medium

    Network Security

    1 total
    1 Critical

    Code Security

    3 total
    1 High
    2 Medium

    Privacy

    2 total
    2 Medium

    Third-Party Services

    Firebase Analytics, Firebase Authentication, Firebase Firestore, Firebase Crashlytics, Firebase Cloud Messaging, Firebase Remote Config, Firebase Dynamic Links, Google Sign-In, Google Measurement, Google Play Integrity, Google reCAPTCHA, Mixpanel, Alignet Payme SDK, Alignet 3D Secure SDK, Mastercard Sonic SDK, Visa SDK

    Security Strengths

    • ✓3D Secure 2.0 authentication implemented for payment processing
    • ✓Bearer token authentication for API requests
    • ✓Standard TLS certificate validation (no SSL bypass)
    • ✓No certificate pinning (acceptable per OWASP 2024 guidance)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    education
    sensitive data
    payment processing
    student records
    authentication
    location
    camera

    Package

    com.upch.cayetanoapp

    Version

    1.61.5 (versionCode: 66)

    Analysis Date

    Feb 3, 2026

    Classes Analyzed

    11,017

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 5 findings (2 critical, 3 medium)

    Network Security - 1 finding (1 critical)

    Code Safety - 0 findings

    Privacy - 2 findings (2 medium)

    Privacy Concerns

    What Data is Collected

    Firebase Analytics and Google Measurement track how users interact with the app, which screens are visited, and how often specific features are used. Mixpanel adds a separate layer of behavioral tracking on top of this. Firebase Crashlytics collects diagnostic data when the app encounters problems on the user's device.

    Third-Party Data Sharing

    User data is shared with the following third parties:

    • Firebase (Google) - Analytics, authentication, cloud database, crash reporting, push notifications, and remote configuration
    • Google - Sign-in, integrity verification, reCAPTCHA challenges, and measurement
    • Mixpanel - Behavioral analytics and usage profiling
    • Alignet - Payment processing via Payme and 3D Secure
    • Mastercard - Payment processing
    • Visa - Payment processing

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy70/100
    Data Security25/100
    Network Security30/100
    Code Safety55/100
    Data Collection75/100
    Data Sharing85/100
    User Control60/100

    Positive Security Features

    • No notable positive security practices were identified in this version of the app.

    Areas for Improvement

    • Data stored on the device has limited protection, making it more accessible to anyone with physical or software access to the device.
    • Data sent and received over the internet travels with less protection than expected, which may affect personal and medical information during transmission.
    • The ability to manage or limit what data the app collects is restricted, giving users less control over their information.

    About This Analysis

    This scorecard is based on static analysis of the app's code and configuration. Scores reflect observed practices at the time of the scan and may not capture all runtime behaviors.

    App Details

    • App Name: Cayetano
    • Package ID: com.upch.cayetanoapp
    • Version: 1.61.5 (build 66)
    • Scan Date: February 3, 2026

    Right of Reply

    Developer not yet contacted