# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Strong. Strong result in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## CatLens - Cat Vision Filter ## What This Means for You Camera images are processed on-device using WebGL shaders, with no network transmission path for photo or video data identified in this build; advertising identifiers and app activity data are shared with Google AdMob and related services for ad delivery, and device identifiers are shared with Firebase and OneSignal for push notification delivery. ## Recommendation: TRUSTED CITT rates this build at 86/100. Camera effects are computed on-device, all network connections use standard TLS, and no behavioral analytics or session-recording SDKs are present. The over-the-air JavaScript update mechanism checks for updates on every launch; developer code signing is not applied to those bundles in this build, which is the primary area for the developer to address. **Best For:** People who enjoy real-time camera filters and want their photo and video data to remain on the device. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 2 findings (2 low) **Network Security:** 0 findings **Code Safety:** 3 findings (1 high, 2 low) **Privacy:** 1 finding (1 low) ## Privacy Concerns ### What Leaves the Device - Device advertising identifier and app activity data: shared with Google AdMob for ad delivery, consistent with the Play Store data safety disclosure (retrieved 2026-08-26) - Device identifiers registered for push notifications: shared with Firebase Cloud Messaging and OneSignal to deliver push notifications - Device installation identifiers: shared with Firebase Installations for service registration - Subscription and purchase state: shared with RevenueCat, Google Play Billing, and Amazon IAP to manage in-app entitlements - JavaScript bundle update requests: made to Expo EAS update servers on each app launch ### What Stays on the Device - Camera images and video frames: processed on-device via WebGL shaders; no network transmission path for photo or video data was identified in this build, meaning camera output stays under the user's control. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google AdMob - Advertising delivery and targeting - Firebase Cloud Messaging - Push notification delivery - Firebase Installations - Device registration for Firebase services - OneSignal - Push notification delivery - RevenueCat - In-app subscription and purchase management - Google Play Billing - In-app purchase processing - Amazon IAP - In-app purchase processing - Expo EAS Updates - Over-the-air JavaScript bundle delivery - PairIP - License verification ## Understanding the Scores **Security:** 85/100 **Privacy:** 90/100 ### Security Breakdown - **Data Security:** 88/100. Sensitive data is protected using hardware-backed encryption. Two low-severity configuration items are noted in Areas for Improvement. - **Network Security:** 100/100. All network connections use standard TLS; no weakened or bypassed configuration was identified in this build. - **Code Safety:** 88/100. Hardware-backed secret storage is implemented correctly. The over-the-air update mechanism does not apply developer code signing to received bundles in this build; this is noted in Areas for Improvement. ### Privacy Breakdown - **Data Collection:** 92/100. Camera and video processing stays on the device. Device advertising identifiers and app activity signals are shared with advertising services, consistent with the Play Store data safety disclosure. - **Data Sharing:** 95/100. Data shared off the device is limited to advertising, push notification, subscription management, and license services that are functional to the app's operation. - **User Control:** 92/100. Standard Android permission controls govern camera and storage access. The advertising identifier may be reset or removed through Android's privacy settings. ## Positive Security Features - All network connections use standard TLS; no weakened or bypassed configuration was identified in this build. - Camera images and video frames are processed on-device; no network transmission path for photo or video data was identified in this build. - Sensitive secrets are stored using hardware-backed encryption provided by the Android KeyStore. - Firebase is linked for push notification delivery only; no behavioral analytics or session-recording use was identified for Firebase in this build. - No session-recording or screen-observation SDKs are present in this build. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Advertising Consent Ordering** The Play Store data safety section (retrieved 2026-08-26) declares that device identifiers may be shared with third parties and that data cannot be deleted. The build links Google AdMob. Whether advertising consent is requested before the advertising identifier is read is determined at the JavaScript runtime layer and was not statically verifiable from this build alone. ### Security Enhancements 1. **Over-the-Air Update Code Signing** The build includes Expo's code signing infrastructure but no developer certificate is configured, so JavaScript bundles received from Expo's update servers are accepted based on the TLS channel alone. Enabling Expo's code signing with a developer certificate would add a cryptographic check that each update originated from the developer's own account. 2. **Android Backup Scope** Two backup exclusion rule files are present in the APK but are not referenced in the manifest, so Android backs up all app data without restriction. Wiring these files to the manifest's backup rule attributes would limit what app data is included in device backups. 3. **Production Build Cleanup** The production build includes a file-sharing path scoped to the full external storage root rather than a specific directory, a development tool activity marked as externally accessible, and a local development server address in the resource strings. Scoping the file-sharing path to the intended directory, removing the development activity's external accessibility flag, and cleaning the resource string would reduce the build's surface area. ## Technical Context **App Type:** Entertainment - Real-time camera filter and animal vision simulator **Classes Analyzed:** 34,843 **Third-Party Services:** 11 **Context Tags:** camera, ads --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Codixus (Metehan Kurucu) **Version:** 1.5.0 (Build 15) **Analysis Date:** 2026-08-26 **Package:** com.codixus.catlens.app ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 1.5.0 analyzed on 2026-08-26 - May not reflect server-side security controls - Cannot detect all runtime behaviors