Scan results

Recommendation: Very Secure

CITT assesses this build as very secure: no third-party tracking SDKs are present, social data flows only to the user's chosen Mastodon server, and push notification payloads are end-to-end encrypted. Account session storage on the device could be strengthened by adding backup exclusion rules and scoping certificate trust to system-installed certificates only; per-instance two-factor authentication is recommended for accounts where security is a priority.

Key Findings

Data Security: 1 finding (1 medium)

Network Security: 1 finding (1 medium)

Code Safety: 4 findings (4 low)

Privacy: 1 finding (1 low)

Privacy Concerns

What Leaves the Device

• User posts, follows, and direct messages: flow to the user's chosen Mastodon instance as the app's core function.
• Push notification routing data: handled by Firebase Cloud Messaging (Google) for delivery. Notification payloads are end-to-end encrypted; the delivery provider cannot read their content.
• A numeric identifier derived from the Mastodon username: included in donation campaign requests that flow to Mastodon's own servers each time the home timeline is loaded while a campaign is active. This identifier is stable across app sessions.

What Stays on the Device

• QR code and barcode scan data: processed on the device using on-device libraries; no scan results are transmitted externally.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Firebase Cloud Messaging (Google) - push notification routing and delivery (notification content is end-to-end encrypted and cannot be read by Google)

No other third-party data sharing was identified in this analysis.

Understanding the Scores

Security: 88/100
Privacy: 95/100

Security Breakdown

• Data Security: 82/100. Account session data is stored on the device in a local database. The current backup configuration does not define rules to exclude this database from device cloud backups, which means it may be included when the device backs up to the cloud.
• Network Security: 91/100. All API and Mastodon instance connections use HTTPS with system-trusted certificate validation.
• Code Safety: 93/100. No native libraries are present in this build, eliminating a large category of memory-safety risk. A secure authorization flow is implemented for authentication on Mastodon servers that support it.

Privacy Breakdown

• Data Collection: 96/100. No advertising identifier is requested or used. No analytics or behavioral tracking SDK is linked in this build.
• Data Sharing: 100/100. All social data flows only to the user's chosen Mastodon server or Mastodon's own first-party infrastructure.
• User Control: 99/100. Users select their own Mastodon server and can migrate between servers while retaining followers. The app provides filtering, list management, and content warning controls.

Positive Security Features

• No third-party analytics, advertising, or tracking SDKs are linked in this build; user behavior is not profiled by any vendor.
• Push notification content is end-to-end encrypted, preventing the delivery provider from reading notification payloads.
• All social data flows only to the user's chosen Mastodon server and Mastodon's own first-party infrastructure.
• QR code and barcode scanning is processed entirely on the device; no scan data is transmitted externally.
• No native libraries are present in this build, eliminating a large category of memory-safety risk.
• A secure authorization flow (PKCE) is implemented for authentication on Mastodon servers that support it.
• No advertising identifier is requested or used.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Donation Request Identifier and Data Safety Declaration
   The Play Store data safety section for this build (retrieved 2026-08-11) states "No data collected." The build contains code that constructs a numeric identifier derived from the user's Mastodon username and includes it as a parameter in requests to Mastodon's donation campaign servers. The identifier is stable across sessions and tied to the user's account handle. Whether this element falls within the Play Store's definition of "collected" data is a question for the developer and Google to resolve; CITT reports only what the build contains and how the published data safety label reads.

Security Enhancements

1. Cloud Backup Scope
   The build's backup configuration does not define rules to exclude the account session database from cloud backups. Adding backup exclusion rules for sensitive database files would limit what is included when device backups are created.

2. Network Certificate Trust Scope
   The build's network security configuration extends certificate trust to user-installed certificates for all connections in production. Scoping this trust to debug builds only would align with Android's default behavior for apps targeting API 24 and above.

3. Diagnostic Logging in Release Build
   The release build retains diagnostic logging statements that emit internal operational details. These are accessible only via a physical USB connection or on a modified device, but removing diagnostic logging from release builds is a standard hardening step.

4. Authorization Flow on Older Servers
   When connecting to older Mastodon servers that do not support PKCE, the build falls back to a simpler authorization flow. Encouraging use of PKCE-capable server versions, or removing the plain-secret fallback, would close this gap for users on older instances.

Technical Context

App Type: Decentralized social networking
Classes Analyzed: 2,288
Third-Party Services: 8
Context Tags: social, messaging, federated, privacy

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Mastodon GmbH
Version: 2.13.2 (Build 189)
Analysis Date: 2026-08-13
Package: org.joinmastodon.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 2.13.2 analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors