Scan results

Recommendation: Solid

Build 8.107.2 combines hardware-backed account protection with a broad third-party SDK footprint. Payment authentication keys are created inside the Secure Enclave and hardware-isolated from all other processes; biometric verification is configured as a prerequisite for releasing those keys. Info.plist is configured to disable HTTPS enforcement globally, meaning third-party SDK connections may reach unencrypted HTTP (not tested at runtime), and the build's privacy manifest declares no data collection while linking analytics and attribution SDKs.

Key Findings

Data Security: 0 findings

Network Security: 2 findings (1 medium, 1 low)

Code Safety: 3 findings (1 medium, 2 low)

Privacy: 1 finding (1 low)

Privacy Concerns

What Leaves the Device

• Contact information: the build contains a contact synchronization feature; whether contacts are sent to PayPal's servers was not tested at runtime.
• Usage and attribution data: Adjust, Firebase Analytics, Adobe Experience Platform, and Sprig are linked, all designed to receive behavioral and usage data; off-device transmission was not tested.
• Session monitoring data: Datadog RUM is linked and designed to receive session data; off-device transmission was not tested.
• Install attribution signals: Apple AdServices and SKAdNetwork are linked for attribution measurement; off-device transmission was not tested.
• Checkout and enrichment data: Rokt and Clearbit are linked; off-device transmission was not tested.

What Stays on the Device

• Payment authentication keys: the build creates and stores these inside the Secure Enclave, hardware-isolated storage that cannot be read or extracted by any other process.
• Biometric verification: Face ID and Touch ID authentication is processed entirely on the device; no biometric data leaves the device.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Adjust - mobile attribution and marketing analytics
• Firebase Analytics - app usage analytics
• Firebase Crashlytics - crash reporting
• Sprig (UserLeap) - in-app surveys and session monitoring
• Datadog RUM - real user monitoring and performance analytics
• Adobe Experience Platform - behavioral and customer analytics
• Rokt - checkout advertising and offers
• Clearbit - contact and business data enrichment
• Plaid (LinkKit) - bank account linking and verification
• Braintree - payment processing
• Apple AdServices and SKAdNetwork - install attribution measurement
• FraudForce - device-based fraud detection
• Didomi - user consent management
• Additional: Loggly (SolarWinds), KnotAPI, Atomic FI, Amazon Chime SDK, iZettle SDK, CardinalMobile, Honey (GiphyUISDK), TrustKit (Data Theorem), Thales TSHPaySDK, FaceTecSDK, Daon, MiSnap

Understanding the Scores

Security: 80/100
Privacy: 77/100

Security Breakdown

• Data Security: 88/100. Build 8.107.2 creates payment authentication keys inside the Secure Enclave and configures biometric verification as a prerequisite for accessing those keys. No data storage weaknesses were identified in this analysis.
• Network Security: 68/100. Info.plist is configured to disable HTTPS enforcement globally and for all in-app web content, removing transport security protections for third-party SDK connections. TrustKit is linked to provide domain verification for PayPal's own API connections.
• Code Safety: 88/100. Build structure and hardware-backed authentication design reflect strong practices. JavaScript files injected into in-app browser sessions register 29 message handlers without page-origin checks, and deprecated networking API references remain present in linked frameworks.

Privacy Breakdown

• Data Collection: 76/100. Multiple analytics and attribution services are linked, including Adjust, Firebase Analytics, Adobe Experience Platform, and Sprig. The build's privacy manifest declares no data types are collected or tracked, a discrepancy with the linked SDK inventory.
• Data Sharing: 82/100. Payment and financial data stays within PayPal's first-party infrastructure based on the keychain entitlements in the build. Third-party analytics, session monitoring, advertising, and enrichment services may receive behavioral data; runtime flows were not tested.
• User Control: 86/100. iOS permission controls govern access to device data, and hardware-enforced biometric verification protects account access. Background location access is declared in the build alongside the foreground-only permission, using identical justification text for both.

Positive Security Features

• Build 8.107.2 creates payment authentication keys inside the Secure Enclave; these keys are hardware-isolated and cannot be read or extracted by any other process on the device.
• Passkeys (FIDO2) support is present, enabling login without passwords and reducing exposure to account takeover through phishing.
• The build configures biometric verification (Face ID and Touch ID) as a prerequisite before authentication keys are released from the keychain; this processing happens locally on the device.
• TrustKit is linked, providing domain verification enforcement for PayPal's own API connections.
• Modern encryption is confirmed in the build for financial data operations.
• Key sharing between PayPal-owned apps (PayPal, Honey, Xoom) is enforced through Apple's Team ID system; only apps from the same developer team can read the shared items.
• The keychain entitlements show that shared account data between PayPal-owned services does not extend to third-party app ecosystems.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Privacy manifest and linked SDK inventory
   Apple's App Store privacy guidelines require developers to disclose data collected through third-party SDKs, including analytics and attribution libraries. Build 8.107.2 links Adjust, Firebase Analytics, Sprig, Adobe Experience Platform, Datadog RUM, and Rokt, all services designed to receive behavioral data. The build's privacy manifest declares no data types are collected or tracked. Whether runtime data flows align with the manifest declaration could not be determined from the binary; a reader comparing the linked SDK list to the declared manifest will find a discrepancy.

2. Background location permission scope
   The build declares a background location permission alongside the foreground-only location permission, using identical justification text for both. Apple's guidelines recommend requesting only the minimum location access required. Whether background location authorization is requested at runtime was not verified in this analysis.

Security Enhancements

1. In-app web content transport security
   Info.plist disables HTTPS enforcement for all in-app web content. Enabling HTTPS enforcement with narrow per-domain exceptions for any required HTTP resources would reduce the exposure of in-app browser sessions to unencrypted content.

2. In-app browser message handler origin verification
   JavaScript files injected into in-app browser sessions register 29 message handlers that respond to calls from any page without checking the page origin. Adding origin verification before processing bridge messages would limit what a compromised or malicious page could trigger.

3. Deprecated networking library references
   Linked frameworks reference networking APIs that Apple deprecated and excluded from public headers in iOS 15+. Updating or replacing the third-party dependencies that introduce these references would remove reliance on unsupported code paths.

Technical Context

App Type: Financial payment platform, high sensitivity level
Classes Analyzed: 0
Third-Party Services: 27
Context Tags: financial, sensitive_data, contacts, location, camera

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Not available
Version: 8.107.2 (build 75)
Analysis Date: 2026-08-13
Package: com.yourcompany.PPClient

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS build 8.107.2 (build 75) analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors