# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Critical issue. Has a high-severity open item in this area, detailed below. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## MyGMC ## What This Means for You The configuration bundle includes production service authentication secrets for Azure, HERE Maps, Telenav, and Arity. Account login data is stored in the iOS Keychain with biometric protection, and behavioral analytics linked to account identity may be sent to ContentSquare. ## Recommendation: TRUSTish The configuration bundle in this build ships production service secrets for GM's Azure API management layer, HERE Maps, Telenav navigation, and Arity telematics, all extractable from the downloadable IPA. The login and session layer is separately protected: account data is stored in the iOS Keychain with biometric binding, and core vehicle service traffic is secured against network interception across all primary GM backend domains. CITT rates this TRUSTish because the exposed secrets concern GM's server-side infrastructure rather than direct access to individual user accounts or vehicle controls, and the protective measures around user login and network traffic are strong. **Best For:** GMC vehicle owners who want full-featured remote vehicle control, including engine start/stop, door locking, charging management, and real-time location tracking. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 6 findings (1 critical, 4 high, 1 low) **Network Security:** 0 findings **Code Safety:** 2 findings (2 low) **Privacy:** 2 findings (1 medium, 1 low) ## Privacy Concerns ### What Leaves the Device - Behavioral data attributed to account identity: may be sent to ContentSquare (Heap) for product analytics, as declared in the Heap privacy manifest bundled with this build. - Vehicle push notification content (remote start alerts, lock/unlock status, charging events): captured by the Heap notification component and may be sent to ContentSquare; runtime transmission was not observed. - In-app web content request and response data: the LuciqSDK (Instabug) bundle is configured to capture this data and forward it to GM's Instabug instance; runtime transmission was not observed. ### What Stays on the Device - Account login data: stored in the iOS Keychain with the highest protection class, including biometric binding. This data is not evidenced as leaving the device and stays under the user's control on the original device. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - ContentSquare (Heap) - behavioral analytics linked to account identity - Instabug (LuciqSDK) - crash reporting and in-app web content monitoring - AppsFlyer - install attribution, gated on ATT consent - Firebase - push notification delivery - Adobe AEP - analytics and personalization - Salesforce - customer relationship management - Datadog - performance monitoring - HERE Maps - mapping and navigation - Telenav - navigation and entity search - Arity (Allstate) - telematics and roadside assistance ## Understanding the Scores **Security:** 47/100 **Privacy:** 83/100 ### Security Breakdown - **Data Security:** 50/100. The configuration bundle ships production service authentication secrets for five external platforms. Login data is separately protected by the iOS Keychain with biometric binding, and cross-app data access is restricted to General Motors' own brand applications. - **Network Security:** 87/100. Transport security for core vehicle service traffic is strong. GM's ten primary backend domains are protected against network interception, and standard secure transport applies across analytics and third-party service connections. - **Code Safety:** 70/100. Build automation scripts and non-production environment references are present in the production bundle, exposing internal infrastructure detail. No memory safety issues were identified in the native compiled binary. ### Privacy Breakdown - **Data Collection:** 86/100. Firebase Analytics is explicitly disabled across all environments; the SDK is present for push notifications only, not behavioral data. Analytics data collection is limited relative to the number of third-party frameworks linked in this build. - **Data Sharing:** 88/100. Data flows are largely restricted to functional and operational services. Behavioral analytics via Heap attributed to account identity is the primary discretionary sharing surface. - **User Control:** 90/100. Advertising attribution is gated behind ATT consent, giving users direct control over advertising identifier access. ## Positive Security Features - Firebase Analytics is disabled in all build environments; the SDK is present only for push notifications, not behavioral data collection. - Account login data is stored in the iOS Keychain with the strongest protection class, including biometric binding that prevents extraction. - Core vehicle service traffic to GM's ten primary backend domains is protected against network interception. - Automated static analysis found no memory safety issues in the native compiled binary. - AppsFlyer advertising attribution is gated behind ATT consent; advertising identifiers are not accessed without explicit user permission. - Datadog performance monitoring in this build does not include session replay, limiting what performance data may leave the device. - Cross-app data access is restricted to General Motors' own four brand applications under a single developer team; no third-party infrastructure can access these shared stores. ## Areas for Improvement ### Disclosure Observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Behavioral analytics attribution disclosure** Apple's App Store privacy label guidance requires that data attributed to user identity be declared under the appropriate category. The Heap privacy manifest bundled with this build declares user identity linked to analytics. A reader comparing the App Store privacy label to the binary-linked Heap manifest may find the full scope of identity-attributed behavioral data is not prominently surfaced in the top-level label. Whether the label fully reflects the current state could not be determined from the build alone. 2. **App privacy manifest coverage** An app privacy manifest (PrivacyInfo.xcprivacy) for the main app binary was not identified in this build. Adding one could make the App Store privacy label more complete by surfacing required-reasons API usage declared directly by the host app. ### Security Enhancements 1. **Service authentication secrets in the configuration bundle** Service secrets for external platforms should be fetched at runtime from a protected server-side configuration service rather than stored in the downloadable app bundle. This change would eliminate the exposure for all affected integrations in a single architectural step. 2. **Build artifacts in production IPA** CI automation scripts, internal proxy references, and non-production environment entries are present in the production build. Removing these from the packaging step would reduce the internal infrastructure detail available in a distributed IPA. 3. **Keychain item backup eligibility** Several Keychain items use a protection class that makes them eligible for inclusion in encrypted iCloud backups, allowing restoration to a different device. Using the device-bound protection class would restrict these items to the original device and raise the bar for credential extraction. ## Technical Context **App Type:** Connected vehicle remote control (location, financial, sensitive data) **Classes Analyzed:** 300 **Third-Party Services:** 21 **Context Tags:** location, financial, sensitive_data, camera, ads --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** General Motors (GM) **Version:** 8.15.0 (Build 8113) **Analysis Date:** 2026-08-26 **Package:** com.gm.myGMC ### Analysis Limitations - Static analysis only (code review without running the app) - Based on IPA version 8.15.0 (Build 8113) analyzed on 2026-08-26 - May not reflect server-side security controls - Cannot detect all runtime behaviors