# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## 1.1.1.1 + WARP: Safer Internet ## What This Means for You This build routes internet traffic through Cloudflare's encrypted WARP tunnel. Account session data is stored without a separate encryption layer, and Firebase crash reporting is configured to forward a persistent account identifier to Google when the app encounters an error. ## Recommendation: Elevated Risk CITT scores this build at 50/100. The tunnel technology is robust: WARP API connections are validated against more than 120 pre-approved server identities and authorization data is stripped from diagnostic logs. The score is pulled down by account session data stored without encryption in a location that Android cloud backup may include, and by Firebase Analytics being configured to initialize before a user consent interaction. **Best For:** Users who want internet traffic routed through an encrypted tunnel from a major infrastructure provider for everyday browsing protection. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security** - 2 findings (1 medium, 1 low) **Network Security** - 2 findings (1 medium, 1 low) **Code Safety** - 2 findings (2 low) **Privacy** - 2 findings (2 low) ## Privacy Concerns ### What Leaves the Device - Account identifier (WARP registration ID): configured to be sent to Google (Firebase Crashlytics) on app crash, alongside app mode and connection type data. - Analytics usage data: may be sent to Firebase Analytics; the build explicitly disables linking to the device advertising ID, but general usage analytics data may still be forwarded. - Attribution measurement data: the build grants Privacy Sandbox attribution access to all SDKs in the process without per-SDK restrictions, so any present SDK may participate in attribution reporting. ### What Stays on the Device - Location data: read from the device for the Trusted Networks feature (to identify the current Wi-Fi network name) and kept on the device. No coordinates are transmitted. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Firebase Crashlytics (Google) - crash reports and a persistent account identifier - Firebase Analytics (Google) - app usage analytics; advertising ID linking is explicitly disabled - Firebase Cloud Messaging (Google) - push notification delivery - Firebase Installations (Google) - app instance identification - Google Ad Services (Privacy Sandbox) - attribution measurement - Zendesk - in-app support requests and help center access - Google Play Billing - subscription management for the WARP+ paid tier ## Understanding the Scores **Security:** 85/100 **Privacy:** 35/100 ### Security Breakdown - **Data Security:** 75/100. The WireGuard private key is protected using hardware-backed encryption. Account session data, however, is stored in standard device storage without a separate encryption layer, and the backup configuration may include those files in Android cloud backup. - **Network Security:** 83/100. WARP API connections are validated against more than 120 pre-approved server identities, making network interception of VPN tunnel communications infeasible for a rogue certificate. The help center component trusts user-installed certificates and allows mixed content in its article display, which could be relevant on a network with an active interceptor. - **Code Safety:** 88/100. Overall code structure is solid. The help center's article display runs with JavaScript enabled, which the Zendesk SDK requires for rendering support content. ### Privacy Breakdown - **Data Collection:** 55/100. Firebase Analytics may initialize and begin forwarding usage data before the user reaches a consent interaction. The build explicitly disables linking analytics to the device advertising ID, which limits one form of cross-app tracking. - **Data Sharing:** 30/100. Usage and crash data are forwarded to multiple Google Firebase services. A persistent account identifier is included in crash reports, creating a data connection between Cloudflare's account system and Google's crash infrastructure that the user cannot independently reset. - **User Control:** 40/100. Controls over analytics and crash reporting are limited. The build does not expose a granular opt-out for Firebase data sharing within the app. ## Positive Security Features - The WireGuard private key is protected using hardware-backed encryption on supported Android devices, so it cannot be read even if the device storage is accessed. - WARP API connections are validated against more than 120 pre-approved server identities, preventing network intermediaries from intercepting VPN tunnel communications. - Authorization and session headers are stripped from diagnostic logs, preventing account data from appearing in support exports. - No advertising networks or behavioral profiling SDKs are present in this build. - Advertising ID collection is explicitly disabled in the build configuration, preventing Firebase from linking analytics events to the device advertising ID. - Location data accessed for the Trusted Networks feature stays on the device. No coordinates are transmitted. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Cloud Backup Scope** The build is configured to allow Android cloud backup without declaring which files to exclude. Android platform guidance for `android:dataExtractionRules` describes how apps can specify exclusions when account session data may be in the backup scope. The Play Store data safety label states that data is encrypted in transit; the backup configuration was not adjusted to reflect whether account session files are excluded. 2. **Analytics Initialization Timing** Firebase Analytics documentation recommends delaying data collection until after a user consent interaction where applicable. Whether the initialization order in this build aligns with the user's consent flow could not be fully determined from static analysis alone; runtime timing was not observed. ### Security Enhancements 1. **Restrict Cloud Backup Scope** Adding data extraction rules to the build configuration would allow the app to exclude account session files from Android's automatic cloud backup, reducing the risk of those files being restored to a different device. 2. **Restrict Attribution API Access** The Privacy Sandbox attribution configuration currently grants all SDKs in the process access to attribution data. Per-SDK access controls would limit which components can participate in attribution measurement. 3. **Improve Crash Report Data Minimization** Replacing the persistent account identifier in crash reports with a non-account-linked session identifier would remove the data connection between Cloudflare's account system and Google's crash infrastructure. ## Technical Context **App Type:** VPN / Network Security Tool **Classes Analyzed:** 13,148 **Third-Party Services:** 10 **Context Tags:** vpn, network_security, sensitive_data, location, analytics --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Cloudflare, Inc. **Version:** 6.38.8 (Build 5431) **Analysis Date:** 2026-08-12 **Package:** com.cloudflare.onedotonedotonedotone ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 6.38.8 analyzed on 2026-08-12 - May not reflect server-side security controls - Cannot detect all runtime behaviors