# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Airbnb ## What This Means for You Booking activity, device identifiers, and location signals are shared with a multi-SDK analytics and fraud detection stack; facial and document images captured during identity verification are processed on-device and do not leave the device to third parties. ## Recommendation: Trustworthy CITT assesses this build trustworthy (83/100). The build validates TLS connections correctly, processes identity verification entirely on-device, and fully clears stored authentication data at logout. Medium findings center on a support screen-sharing session that the build code may resume without fresh user confirmation, and an in-app browser bridge with broad native API access gated by a domain allowlist; runtime behavior of both was not tested. **Best For:** Travelers who want a full-featured accommodation and experience booking marketplace. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 low) **Network Security:** 2 findings (1 medium, 1 low) **Code Safety:** 9 findings (3 medium, 6 low) **Privacy:** 1 finding (1 low) ## Privacy Concerns ### What Leaves the Device - Behavioral and session analytics: shared with Firebase Analytics and Google Analytics (GA4) for usage measurement - Attribution and referral data: shared with Singular and Branch for marketing attribution - Device identifiers and behavioral signals: shared with FingerprintJS Pro, which maintains a persistent cross-session device identifier on its own servers - Location signals and hardware fingerprint: shared with Incognia for fraud detection; the SDK in this build is configured to exclude the installed apps list from its signals - Crash and performance data: shared with Bugsnag and ProductScience for stability monitoring - Social login account information: shared with Facebook SDK and Naver Login during social login flows - Payment data: shared with Braintree, Stripe, Razorpay, Adyen, Klarna, Worldline, Alipay, and WeChat Pay for payment processing ### What Stays on the Device - Facial images and government document scans captured during KYC identity verification are processed on-device by Google ML Kit; this data does not leave the device to third-party servers. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Firebase Analytics / Firebase Messaging - Usage analytics and push notification delivery - Google Analytics (GA4) - Behavioral measurement - Singular - Marketing attribution - Branch - Link attribution and referral tracking - Incognia - Location-based fraud detection - FingerprintJS Pro - Persistent cross-session device identification - ArkoseLabs - Bot and fraud detection - Play Integrity / SafetyNet - Device attestation - Braintree - Payment processing - Cardinal Commerce - Payment authentication - Stripe - Payment processing - Klarna - Buy-now-pay-later payments - Razorpay - Payment processing (India market) - Adyen - Payment processing - Worldline - Payment processing - Alipay - Payment processing (China market) - WeChat Pay - Payment processing (China market) - Facebook SDK - Social login - Naver Login - Social login (Korean market) - Google Maps SDK - Map display - Google ML Kit - On-device identity and document processing - Median CoBrowse - Support screen co-browsing - ProductScience - Performance monitoring - Bugsnag - Crash reporting ## Understanding the Scores **Security:** 85/100 **Privacy:** 82/100 ### Security Breakdown - **Data Security:** 88/100. Stored data handling is well-structured overall, with hardware-backed encryption used for sensitive stored data and an explicit exclusion of authentication data from Android backup. The single finding in this category is a low-severity fallback path in receipt PDF download that may place the file in a publicly accessible downloads folder on older Android versions. - **Network Security:** 88/100. TLS validation is correctly implemented with no overriding code found in this build. The two findings are scoped to a Chinese regional configuration: a network security configuration file that permits unencrypted HTTP to Chinese carrier authentication domains, and a map tile URL builder using an HTTP base address for that market. - **Code Safety:** 83/100. Most exported component handling follows Android platform conventions. Three medium findings involve a support screen-sharing session that the build code may resume from a stored identifier without a fresh user prompt, an in-app browser bridge with broad native API access gated by domain allowlist at construction time, and a WeChat callback that forwards navigation links without validating their destination; runtime behavior of all three was not tested. Six lower-severity findings cover exported components without permission restrictions and build configuration artifacts. ### Privacy Breakdown - **Data Collection:** 85/100. The app links an analytics and fraud detection stack that gathers behavioral and location data; identity verification data is processed on-device with no evidenced off-device flow to third parties. - **Data Sharing:** 87/100. Data sharing is distributed across payment processors, attribution services, fraud detection providers, and analytics platforms consistent with a global travel marketplace; no evidence of data broker or open advertising network sharing was found in this build. - **User Control:** 85/100. Stored authentication data is fully cleared at logout across multiple storage locations. Android backup scope is restricted to a non-sensitive device identifier. ## Positive Security Features - TLS certificate validation is correctly implemented; the build cancels all SSL errors rather than overriding them. - Identity and document verification for KYC is handled entirely on-device by Google ML Kit; raw facial and document images are not forwarded to third-party servers. - Hardware-backed encryption is used for sensitive stored data, demonstrating that the capability is in place in this build. - Stored authentication data is fully cleared at logout, including local storage, account manager entries, browser session data, and push notification registrations. - Android backup scope is restricted to a non-sensitive device identifier; authentication data is explicitly excluded. - The Incognia fraud SDK in this build is configured to exclude the installed apps inventory, limiting its signals to location and hardware fingerprinting. ## Areas for Improvement ### Disclosure observations 1. **Analytics and fraud SDK stack disclosure** Google Play's data safety guidance asks developers to disclose all data types shared with third parties and the purpose for each. This build links FingerprintJS Pro, Incognia, Firebase Analytics, Google Analytics, Singular, Branch, and others. Whether each SDK's data collection is fully reflected in the current Play Store data safety label could not be determined from the binary alone; readers may compare the Play Store label against the third-party list above. 2. **Cleartext network configuration scope** The network security configuration in this build permits unencrypted HTTP for several Chinese carrier authentication domains and a map tile service. Google's network security guidance recommends HTTPS for all production traffic. Whether these code paths are reachable for users outside China, or could be migrated to HTTPS, was not determined from this build. ### Security Enhancements 1. **Support session resumption** Industry practice for screen co-browsing recommends requiring explicit user confirmation each time a session resumes, rather than relying on a stored session identifier delivered via push notification. 2. **In-app browser native bridge scope** Narrowing the native capabilities accessible through the in-app browser bridge to the minimum set required per feature would reduce the potential impact of future web content issues. 3. **Exported component access controls** Adding explicit Android permission requirements to components that are accessible to other installed apps without restriction would prevent those components from being launched out of context by third-party applications. ## Technical Context **App Type:** Travel marketplace, financial transactions, social, location-aware **Classes Analyzed:** 89,952 **Third-Party Services:** 25 **Context Tags:** financial, social, location, camera, sensitive_data, ads --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Airbnb, Inc. **Version:** 26.13 (versionCode 28021224) **Analysis Date:** 2026-08-13 **Package:** com.airbnb.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 26.13 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors