# Security & Privacy Scorecard

## GitHub

## What This Means for You

User activity is reported to Firebase, including crash diagnostics and session data. Code, repositories, and account interactions are processed on GitHub servers, and Firebase services collect usage patterns from user sessions. Users have reasonable control over their account data, but third-party reporting runs in the background whenever the app is in use.

## Recommendation: Use With Caution

**Best For:** Developers comfortable with standard crash reporting

## Key Findings

**Data Security** - 6 findings (1 critical, 2 high, 3 medium)

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 4 findings (1 critical, 3 medium)

## Privacy Concerns

### What Data is Collected

Firebase services collect crash diagnostics, session identifiers, device information, and usage patterns each time the app is opened and used. Account activity, including repository interactions and code browsing, is processed on GitHub's servers.

### Third-Party Data Sharing

Session and diagnostic data is shared with Google's Firebase platform, which processes crash reports and usage analytics. Firebase Cloud Messaging routes notification delivery through Google's infrastructure using device registration data.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 40/100 |
| Data Security | 35/100 |
| Network Security | 85/100 |
| Code Safety | 50/100 |
| Data Collection | 55/100 |
| Data Sharing | 60/100 |
| User Control | 65/100 |

## Positive Security Features

- No specific positive security practices were identified for this app.

## Areas for Improvement

- Data handling practices could be strengthened to better protect sensitive information stored and processed on the device.
- The range of data collected by background analytics services could be narrowed to what is strictly needed for core functionality.
- Providing clearer controls for managing background reporting would give users more visibility into what information leaves the device.

---

## About This Analysis

### App Details

| Field | Value |
|---|---|
| App | GitHub |
| Package | com.github.android |
| Version | 1.219.1 (Build 10265) |
| Scan Date | 2026-01-24 |