CITT

    Scan results

    World App - Real Human Network

    Android

    World is a real human network mobile app providing proof of humanity via World ID for online authentication, access to mini-apps ecosystem, and digital wallet functionality using USDC with no transaction fees.

    CITT SCORE
    58
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Tech-savvy users who understand the risks and value zero-knowledge identity verification

    Not For: Privacy-focused users uncomfortable with extensive tracking or users handling large crypto assets

    What It Means For You

    WebView file access vulnerability allows malicious scripts to read sensitive local data

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (20)

    Data Security

    7 total
    1 Critical
    2 High
    3 Medium
    1 Low

    Network Security

    2 total
    2 Medium

    Code Security

    8 total
    1 Critical
    4 High
    3 Medium

    Privacy

    2 total
    2 Medium

    Third-Party Risk

    1 total
    1 Medium

    Third-Party Services

    Turnkey, PostHog, Braze, Firebase, AppsFlyer, Statsig, Datadog, Fingerprint.js, Regula Document Reader, XMTP, Zendesk, Google Play Services, ML Kit

    Security Strengths

    • ✓Certificate pinning implemented for main API endpoints
    • ✓Android Keystore integration with hardware-backed encryption
    • ✓Zero-knowledge proofs for privacy-preserving authentication
    • ✓End-to-end encryption for chat and backups
    • ✓Google Tink for AES-256-GCM/SIV encryption
    • ✓Standard backups disabled to prevent Google Cloud exposure
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    crypto
    identity
    biometric
    camera
    location
    contacts
    sensitive data
    ads
    analytics

    Package

    com.worldcoin

    Version

    2.9.701

    Analysis Date

    Dec 18, 2025

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Significant Security Concerns

    Verdict: Critical WebView vulnerability allows file access to local data, centralized wallet infrastructure, and excessive tracking SDKs. Only recommended for tech-savvy users understanding the risks; unsuitable for privacy-focused users or those holding significant assets.

    Risk Summary:

    • Security Risk: Moderate to High (WebView vulnerability, wallet centralization)
    • Privacy Risk: Moderate (extensive tracking, device fingerprinting)
    • Data Protection: Moderate (unencrypted database, broad file access)

    Recommendations for Users:

    1. Use only on non-rooted devices to protect local database
    2. Keep small balances in the wallet due to centralized infrastructure
    3. Be cautious when using mini-apps from unknown sources
    4. Review and minimize granted permissions when possible
    5. Keep the app updated to receive security patches

    Analysis Metadata

    • Version Analyzed: 2.9.701
    • Analysis Date: December 18, 2025
    • Classes Analyzed: 0
    • Report Type: Public Security Scorecard

    This analysis is based on static code analysis and may not reflect runtime behavior or server-side security measures. Security and privacy practices may change with app updates.

    Powered by canITrustThat APK Security Analysis

    Right of Reply

    Developer not yet contacted