CITT

    Scan results

    WooCommerce: Store & POS

    Android

    Manage your online store from anywhere with WooCommerce mobile app. Create and edit products, manage orders, process payments in-person, and track real-time sales analytics. Built by Automattic for Android 8.0+.

    CITT SCORE
    38
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: WooCommerce store owners comfortable with analytics

    What It Means For You

    Usage patterns and in-app behavior are tracked by Firebase, Google Analytics, and Automattic's own analytics service. Store activity data may also reach Sentry for crash reporting. Payment interactions involve the Stripe Terminal SDK, and support requests pass through Zendesk.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (16)

    Data Security

    7 total
    2 Critical
    3 High
    2 Medium

    Network Security

    3 total
    1 Critical
    2 Medium

    Code Security

    2 total
    1 High
    1 Medium

    Privacy

    4 total
    2 Critical
    1 High
    1 Medium

    Third-Party Services

    Firebase Analytics, Automattic Tracks, Sentry, Google Analytics, Zendesk, Stripe Terminal SDK

    Security Strengths

    • ✓No JavaScript interfaces in WebViews (eliminates RCE risk)
    • ✓EncryptedSharedPreferences used correctly for Application Passwords with AES-256-GCM
    • ✓Modern Jetpack Compose architecture with MVVM pattern
    • ✓Stripe Terminal SDK handles payments in isolated process (PCI-compliant)
    • ✓ProGuard/R8 obfuscation enabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    ads
    location
    camera

    Package

    com.woocommerce.android

    Version

    23.5 (703)

    Analysis Date

    Jan 21, 2026

    Classes Analyzed

    10,000

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 7 findings (2 critical, 3 high, 2 medium)

    Network Security - 3 findings (1 critical, 2 medium)

    Code Safety - 0 findings

    Privacy - 4 findings (2 critical, 1 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    Store management activity, browsing and navigation patterns, device identifiers, and crash diagnostics are gathered during normal use. Multiple analytics pipelines receive this data concurrently.

    Third-Party Data Sharing

    • Firebase Analytics - behavioral analytics and usage tracking
    • Google Analytics - usage tracking
    • Automattic Tracks - analytics by the app developer
    • Sentry - crash and error reporting
    • Zendesk - customer support interactions
    • Stripe Terminal SDK - payment processing

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy30/100
    Data Security40/100
    Network Security50/100
    Code Safety75/100
    Data Collection35/100
    Data Sharing40/100
    User Control25/100

    Positive Security Features

    • No notable positive security practices were identified.

    Areas for Improvement

    • Store and behavioral data reaches multiple third-party analytics providers at once, with no opt-out available from within the app.
    • Payment and business data flows through third-party services with limited transparency about how long that data is retained or how it is used downstream.
    • Users have little control over what is collected or shared: the app offers minimal privacy settings to adjust data collection scope.

    About This Analysis

    Scores reflect security and privacy practices observed in the app's code and configuration at the time of analysis.

    App Details

    • App: WooCommerce: Store & POS
    • Package ID: com.woocommerce.android
    • Version: 23.5 (703)
    • Scan Date: 2026-01-21

    Right of Reply

    Developer not yet contacted