# Security & Privacy Scorecard

## Apple Wallet (Passbook)

## What This Means for You

Your passes, payment cards, and boarding information are kept entirely within Apple's ecosystem, with no data shared with advertising networks, analytics services, or any other third parties.

## Recommendation: Secure Official App

Apple's official Wallet with no third-party trackers or SDKs. Excellent security practices. Safe for all users. Only minor: missing data protection class entitlement.

**Best For:** All iPhone users - this is Apple's built-in Wallet app with no third-party SDKs or data collection

## Key Findings

**Data Security** - 2 findings (1 low, 1 info)

**Network Security** - 2 findings (2 info)

**Code Safety** - 2 findings (2 info)

**Privacy** - 3 findings (3 info)

## Privacy Concerns

### What Data is Collected

- Pass and ticket data: boarding passes, loyalty cards, event tickets
- Payment card information (managed by Apple Pay / Secure Enclave)
- Device information required for pass syncing via iCloud

### Third-Party Data Sharing

No third-party data sharing was identified in this analysis.

## Understanding the Scores

**Security:** 97/100
**Privacy:** 100/100

### Security Breakdown

- **Data Security:** 94/100 - Strong protection overall; sandbox files default to a slightly lower protection class without an explicit data protection entitlement
- **Network Security:** 100/100 - All connections require HTTPS/TLS 1.2 or higher by default; no cleartext exceptions configured
- **Code Safety:** 100/100 - No web rendering surface, no JavaScript bridge, and all external data ingestion delegates to Apple OS frameworks

### Privacy Breakdown

- **Data Collection:** 100/100 - No analytics, advertising, or behavioral tracking libraries present
- **Data Sharing:** 100/100 - Zero external network destinations detected; no data sent to third parties
- **User Control:** 100/100 - No tracking or profiling mechanisms found

## Positive Security Features

- No third-party SDKs, analytics services, or advertising libraries embedded
- All network connections require HTTPS with TLS 1.2 or higher - no cleartext exceptions
- Secure state restoration correctly implemented using the modern protected variants
- No web content rendering surface and no JavaScript-to-native bridge
- No custom URL schemes or universal links - cannot be invoked by malicious external apps
- All sensitive payment and card operations handled by Apple's OS-level Secure Enclave frameworks

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Explicit File Protection Class Declaration**
   Adding an explicit data protection entitlement would ensure all sandbox files are locked when the device screen is locked, rather than remaining accessible after the first unlock since boot.

### Security Enhancements

1. **Data Protection Class Upgrade**
   Declaring the highest file protection class in the app entitlements would provide an additional layer of defense for any pass data written to the local sandbox, particularly relevant for users storing sensitive financial or identity passes.

## Technical Context

**App Type:** Financial / digital wallet - high sensitivity
**Classes Analyzed:** 21
**Third-Party Services:** 0
**Context Tags:** financial, sensitive_data

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Apple Inc.
**Version:** 6.6 (Build 1)
**Analysis Date:** 2026-04-17
**Package:** com.apple.Passbook

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 6.6 (Build 1) analyzed on 2026-04-17
- May not reflect server-side security controls
- Cannot detect all runtime behaviors