Scan results

Recommendation: Solid

CITT rates this build Solid: the login flow uses a robust authorization code method that limits the impact of code interception, API communications are well-secured, and three analytics services require explicit consent before receiving any data. Weighed against those strengths are preconsent data flows to Firebase, Salesforce Marketing Cloud, and Intercom, and account and location data stored without encryption on the device.

Key Findings

Data Security: 1 finding (1 medium)

Network Security: 2 findings (2 medium)

Code Safety: 3 findings (2 medium, 1 low)

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

• Account and device identifiers: shared with Firebase Analytics, Salesforce Marketing Cloud, and Intercom, with the initial data routing occurring before the in-app consent prompt is presented on first launch
• Usage analytics: shared with Firebase Analytics and, after consent is granted, with Mixpanel (EU-region endpoint)
• Crash reports and performance diagnostics: shared with Firebase Crashlytics and Firebase Performance, and after consent with Sentry
• Advertising identifier: shared with AppsFlyer for install attribution, gated behind user consent
• Identity document and biometric data: shared with Onfido during identity verification onboarding
• Push notification registration: device identifiers shared with Firebase Messaging to enable push notifications
• Location proximity data: the binary links AltBeacon and the Salesforce Marketing Cloud proximity SDK; whether location data is shared at runtime could not be determined from static analysis

What Stays on the Device

No sensitive data was identified as processed only on the device in this analysis.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Firebase (Analytics, Crashlytics, Performance, Messaging) - usage analytics, crash reporting, performance monitoring, push notifications
• Salesforce Marketing Cloud - marketing communications and in-app messaging
• Intercom - in-app customer support and messaging
• AppsFlyer - install attribution (consent-gated)
• Onfido - identity verification and document review
• Mixpanel - usage analytics, routed to EU region (consent-gated)
• Sentry - error and crash reporting (consent-gated)
• Usercentrics - consent management platform
• AltBeacon - proximity beacon infrastructure (runtime activation not determined from static analysis)
• Google Maps Platform - map display
• Usersnap - in-app user feedback

Understanding the Scores

Security: 85/100
Privacy: 65/100

Security Breakdown

• Data Security: 58/100. Account and location data are stored on the device without encryption, and the backup configuration includes files that may contain session and account data not currently excluded from cloud or device backup. These areas could be strengthened.
• Network Security: 84/100. API communications are secured with server-identity verification at the transport layer. The Intercom in-app messaging component allows HTTP resources to load within HTTPS pages while a JavaScript interface is attached, which could be leveraged by a network-positioned attacker to inject content into the in-app support view.
• Code Safety: 84/100. Login uses a robust authorization code flow with PKCE (per RFC 7636), reducing the risk of authorization code interception. Testing framework components and non-production server addresses are present in this release build.

Privacy Breakdown

• Data Collection: 72/100. Several analytics and messaging services are present; AppsFlyer, Mixpanel, and Sentry are gated behind user consent, while Firebase Analytics, Intercom, and Salesforce Marketing Cloud appear configured to route data before the consent prompt is shown on first launch.
• Data Sharing: 75/100. Sharing is scoped to services with defined purposes such as attribution, analytics, support, and identity verification; no broad advertising network SDK is present.
• User Control: 82/100. A Usercentrics consent platform gives the user control over several analytics services. The Play Store label indicates users may request deletion of their data.

Positive Security Features

• API communications in this build are secured with server-identity verification at the transport layer, with no bypass configuration found
• Login uses a robust authorization code flow (PKCE per RFC 7636) that reduces the risk of authorization code interception
• AppsFlyer, Mixpanel, and Sentry are gated behind the Usercentrics consent platform and are not configured to receive data before user consent is granted
• Identity verification is managed through a short-lived, server-generated session via Onfido, running in an isolated process rather than a hardcoded client identifier
• Mixpanel is configured to route analytics exclusively to an EU-region endpoint, keeping that data within EU jurisdiction
• No broad advertising network SDK is present; the only attribution service (AppsFlyer) is limited to install attribution and is consent-gated

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Preconsent data routing on first launch
   Google Play's Data Safety guidance (retrieved 2026-08-12) requires disclosure when personal data is shared with third parties. The binary links Firebase Analytics, Salesforce Marketing Cloud, and Intercom in configurations that appear capable of routing device and account data before the in-app consent prompt is shown on first launch. Whether server-side controls prevent data from reaching those services before consent is granted could not be determined from static analysis alone.

2. Beacon proximity infrastructure not reflected in Play Store label
   The binary includes AltBeacon and the Salesforce Marketing Cloud proximity SDK, libraries associated with Bluetooth beacon-based location tracking. The Google Play Data Safety label (retrieved 2026-08-12) does not name proximity or beacon tracking among the data types shared with third parties. Whether these libraries route location data at runtime could not be determined from static analysis.

3. Install attribution recipient not named in Play Store label
   The binary links AppsFlyer, configured to receive the advertising identifier when the user grants consent. The Play Store Data Safety label (retrieved 2026-08-12) discloses that "Personal info" may be shared with third parties but does not name AppsFlyer as a recipient by name.

Security Enhancements

1. Expand backup exclusions to cover account and session data files
   The current backup configuration excludes only AppsFlyer-specific files. Expanding the exclusion rules to cover account preference files and session data storage would prevent those files from being copied to cloud backup or restored to a different device.

2. Restrict mixed-content loading in in-app messaging views
   The Intercom in-app messaging component allows HTTP resources within HTTPS pages in its views. Configuring those views to reject HTTP subresources would reduce the risk of network-based content injection affecting in-app actions.

3. Remove testing framework components from production builds
   This release build includes testing framework activities that any co-installed app can start without restriction. Ensuring debug-only dependencies are excluded from the production build configuration would reduce the exposed surface area.

Technical Context

App Type: Business - gig work and temporary employment platform (sensitive: employment, financial, biometric, location data)
Classes Analyzed: 0
Third-Party Services: 16
Context Tags: employment, financial, sensitive_data, location, ads, biometric

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Temper IP B.V.
Version: 1.21.2 (versionCode 290)
Analysis Date: 2026-08-12
Package: temper.worker.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.21.2 analyzed on 2026-08-12
• May not reflect server-side security controls
• Cannot detect all runtime behaviors