# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Strong. Strong result in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Bitwarden Authenticator ## What This Means for You Build 2026.7.0 stores two-factor authentication secrets in a database configured for inclusion in Google cloud backups. A compromised Google account could potentially give an unauthorized party access to enrolled 2FA accounts (was not tested at runtime). ## Recommendation: Elevated Risk The backup configuration is the primary concern: the TOTP secrets database is explicitly included in both Google cloud backups and device-to-device transfers, with no exclusion rule for this file. The app demonstrates strong practices otherwise, including on-device code generation, no advertising SDKs, and well-protected cryptographic keys for biometric unlock. The overall score reflects the impact of this storage configuration against an otherwise strong security and privacy profile. **Best For:** People who want a two-factor authentication app with no advertising and on-device code generation. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 high) **Network Security:** 0 findings **Code Safety:** 2 findings (2 low) **Privacy:** 0 findings ## Privacy Concerns ### What Leaves the Device - App performance and crash data: may be sent to Google via Firebase Crashlytics (runtime transmission was not observed in the analyzed build). - App installation identifiers: may be sent to Google via Firebase Installations (runtime transmission was not observed in the analyzed build). ### What Stays on the Device - Two-factor authentication secrets (TOTP seeds): kept on the device. No off-device transmission of authentication secrets was evidenced in this build. Verification codes are generated locally. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google (Firebase Crashlytics) - crash reporting and app performance data - Google (Firebase Cloud Messaging) - push notification delivery infrastructure - Google (Firebase Installations) - app installation identifier management ## Understanding the Scores **Security:** 82/100 **Privacy:** 35/100 ### Security Breakdown - **Data Security:** 73/100. The TOTP authentication database is stored without an additional encryption layer and is explicitly included in cloud backup and device-to-device transfer configurations. Cryptographic keys for the inter-app bridge and biometric unlock are stored in protected system storage and excluded from backups. - **Network Security:** 100/100. Network connections in this build use the platform's standard certificate validation. No custom trust configurations or validation bypasses were found. - **Code Safety:** 99/100. Strong safety practices are evident throughout the codebase. Cryptographic keys for biometric unlock and the inter-app bridge are stored in the Android Keystore. ### Privacy Breakdown - **Data Collection:** 95/100. No advertising, behavioral analytics, or data broker SDKs are present. Firebase Crashlytics is the only third-party data link, limited to app performance and crash reporting. - **Data Sharing:** 30/100. App performance and crash data may be shared with Google via Firebase Crashlytics. The Play Store data safety label (retrieved August 2026) notes this data "can't be deleted" once submitted. No advertising or data broker sharing was identified. - **User Control:** 40/100. The backup configuration explicitly includes the TOTP database, and the build does not surface an in-app control to exclude this file from cloud backups. The build does not include a consent prompt for crash reporting, and the default configuration does not suppress it (runtime behavior was not observed). ## Positive Security Features - TOTP verification codes are generated entirely on the device. No off-device transmission of authentication secrets was evidenced in this build. - No advertising networks or behavioral analytics SDKs are present in this build. - Cryptographic keys for biometric unlock and the inter-app bridge are stored in the Android Keystore and excluded from device backups. - Network connections use the platform's standard certificate validation with no custom trust configurations. - OAuth authentication flows use Android Custom Tabs for sign-in, avoiding a class of JavaScript-related risks. - The inter-app data bridge to Bitwarden Password Manager uses certificate fingerprint verification, restricting bridge access to verified Bitwarden apps. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Backup configuration and data safety disclosure** The Play Store data safety section (retrieved August 2026) states the app "may share" and "may collect" app info and performance data, and that "Data can't be deleted." Google's Android developer guidance documents how to use exclusion rules in `data_extraction_rules.xml` to prevent sensitive files from entering cloud backups. The analyzed build's backup configuration includes a database wildcard rule covering the entire database directory, including the TOTP secrets database, with no exclusion rule for that file. A reader comparing the disclosure with the backup configuration would note this gap. ### Security Enhancements 1. **Encrypt the authentication database** Adding a separate encryption layer to the local TOTP secrets database would reduce risk if the backup is accessed by an unauthorized party or a device is transferred. 2. **Exclude the authentication database from cloud backups** Adding an explicit exclusion for the TOTP secrets database in the backup configuration would prevent it from being included in Google cloud backups and device-to-device transfers. 3. **Crash reporting opt-out** Providing users a visible control to opt out of crash data sharing before or during first use would give people more control over what app performance data is sent to Google. ## Technical Context **App Type:** Two-factor authentication, high sensitivity **Classes Analyzed:** 11,264 **Third-Party Services:** 3 **Context Tags:** sensitive_data, camera --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Bitwarden Inc. **Version:** 2026.7.0 (Build 1805) **Analysis Date:** 2026-08-13 **Package:** com.bitwarden.authenticator ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 2026.7.0 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors