Scan results

Recommendation: Use With Caution

The app's security foundation is strong, with HTTPS-only networking and hardware-backed protection for your login session. Two development artifacts remain in the production release - a test login callback and a network security override in a third-party plugin. The secure browser-based login flow and plugin-level scoping reduce the practical risk, making this a reasonable choice for AA members who keep their app updated.

Key Findings

Data Security - 2 findings (1 low, 1 info)

Network Security - 1 finding (1 medium)

Code Safety - 4 findings (1 medium, 1 low, 2 info)

Privacy - 1 finding (1 info)

Privacy Concerns

What Data is Collected

• Personal information: membership details, name, email address
• Location data: used for roadside assistance requests and finding nearby AA services
• Device information: device identifiers for push notifications and analytics
• Usage data: app interactions, trip tracking data, journey costs, fuel usage

Third-Party Data Sharing

The following third parties may receive your data:

• Firebase (Google) - app performance monitoring, crash reporting, and push notifications
• Google Maps - location data for finding AA services and navigation
• Auth0 - user login and session management
• Google Ads Identifier - advertising identifier for analytics purposes
• Google Tag Manager - campaign tracking configuration (currently no active tags configured)

Understanding the Scores

Security: 92/100
Privacy: 98/100

Security Breakdown

• Data Security: 97/100 - Strong on-device encryption for stored data, including hardware-backed login session protection and an encrypted local database
• Network Security: 93/100 - All connections use HTTPS by default; a dormant network security override is present in a third-party download plugin
• Code Safety: 93/100 - Release build is hardened with backup disabled and debug mode off; two development artifacts remain in the production configuration

Privacy Breakdown

• Data Collection: 100/100 - Analytics and push notification collection are disabled at startup and only activated after user consent
• Data Sharing: 100/100 - Data sharing limited to services directly supporting app functionality
• User Control: 100/100 - Users can request data deletion; consent controls for analytics are implemented

Positive Security Features

• App data backup is disabled, preventing extraction via connected computers or cloud backup
• All network connections use HTTPS with no cleartext traffic permitted
• Login uses a secure browser-based flow with built-in protection against interception
• Login session stored in the Android Keystore with hardware-backed protection
• Secure storage library used for sensitive app data, backed by Android hardware security
• Analytics and push notification collection disabled at startup, requiring explicit consent
• Local database protected with strong encryption
• In-app browser cross-origin file access protections enforced
• Release build is not set to debug mode
• App verifies it is installed from the Play Store and terminates unlicensed installs

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Remove the Test Login Callback
   The production app contains a development-era login redirect that was not removed before release. Removing it would eliminate a surface through which other installed apps could trigger unexpected login states.

2. Confirm Maps SDK Key Restrictions
   The Google Maps SDK key embedded in the app should be confirmed as restricted to this app's signing certificate in Google Cloud Console to prevent potential misuse against the developer's billing account.

Security Enhancements

1. Add Release Guard to Network Override Feature
   A network security override in the background downloader plugin is available without any release-mode restriction. Adding a debug-only condition would ensure it cannot be activated in production builds.

2. Document Database Encryption Key Management
   The app uses an encrypted local database, but the source of the encryption key could not be verified from the analyzed code. Confirming this uses hardware-backed key derivation would strengthen the security guarantee for users on all device types.

Technical Context

App Type: Transportation and membership services, location-aware
Classes Analyzed: 12,769
Third-Party Services: 17 services identified
Context Tags: transportation, location, financial, analytics

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: NZ Automobile Association
Version: 1.2.1 (Build 10200150)
Analysis Date: 2026-05-06
Package: nz.co.aa.mobile.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.2.1 analyzed on 2026-05-06
• May not reflect server-side security controls
• Cannot detect all runtime behaviors