# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Critical issue. Has a high-severity open item in this area, detailed below. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Under review. This area was not fully assessed in this version. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## GoodLeap Home ## What This Means for You GoodLeap Home's production build contains an embedded authentication secret that may expose internal GoodLeap backend services to anyone who downloads the APK; the build also links multiple analytics and marketing services configured to begin data collection at launch without an explicit consent step. ## Recommendation: Use With Caution CITT's analysis of version 1.6.5 (Build 232) found an authentication secret embedded in the app's bundled configuration files, which may allow access to GoodLeap's internal backend services by anyone who obtains the APK. Analytics and marketing services in this build, including RudderStack, Salesforce Marketing Cloud, and Pendo, appear configured to begin data collection at app launch without a consent gate. Login session data uses hardware-backed encryption and the login flow uses a browser-based approach with a secure verification step, which are meaningful security strengths for a financial app handling payment data. **Best For:** GoodLeap homeowners who need to manage loan payments, track home improvement projects, and monitor solar energy usage. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 3 findings (1 critical, 2 medium) **Network Security:** 1 finding (1 high) **Code Safety:** 5 findings (2 medium, 3 low) **Privacy:** 4 findings (3 medium, 1 low) ## Privacy Concerns ### What Leaves the Device - Behavioral event data and advertising identifier: the build links RudderStack and configures it to gather app event data and the Google Advertising ID; no advertising opt-out check was found in the analyzed build, though server-side controls were not tested. - Marketing interactions and push preferences: Salesforce Marketing Cloud is initialized at launch in the build's configuration without a consent gate; the SDK is designed to send contact identifiers and push registration data to Salesforce servers, though runtime transmission was not observed. - In-app session interaction data: the Pendo SDK's screen capture and session recording features are linked and registered in this build; whether captured frames are sent to Pendo servers and how financial screens are masked depends on runtime configuration not inspectable from the binary. - App event data: the Facebook App Events SDK is linked in this build and may send app interaction data to Facebook; runtime behavior was not observed. - Performance and error diagnostics: Datadog RUM is linked in the build for performance monitoring and may send diagnostic data to Datadog servers; runtime behavior was not observed. - Payment processing: payment data is sent to Stripe to process transactions. - Authentication: login flows are handled via Auth0 as the identity provider. - Push notifications: delivery is handled via Firebase Cloud Messaging. ### What Stays on the Device - Login session data: stored with hardware-backed encryption on the device, protecting it from access by other apps installed on the same device. This data does not leave the device. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - RudderStack - behavioral analytics and advertising identifier collection - Salesforce Marketing Cloud - marketing automation, push notifications, and analytics - Pendo - session analytics and screen interaction recording - Facebook App Events - app event analytics - Datadog RUM - performance and error monitoring - Auth0 - user authentication - Stripe - payment processing - Firebase - push notification delivery - LaunchDarkly - feature flag management ## Understanding the Scores **Security:** 65/100 **Privacy:** 78/100 ### Security Breakdown - **Data Security:** 65/100. This build bundles authentication configuration files containing embedded secrets, as well as development and sandbox environment configuration files that should not be present in a production release. App data backup to cloud storage is also not restricted in this build's configuration. - **Network Security:** 75/100. The network security configuration in this build explicitly permits unencrypted HTTP communication to one server address, overriding Android's default enforcement of encrypted connections for that host. - **Code Safety:** 80/100. The login flow uses a browser-based approach with a secure code-exchange verification step, and device integrity and tamper detection are implemented. Several routing components in the analyzed build accept external navigation inputs without host restrictions, which may be addressable in a future release. ### Privacy Breakdown - **Data Collection:** 74/100. The build links multiple analytics and marketing services, including behavioral tracking and a session recording SDK. Advertising identifier collection does not appear gated on user opt-out status in the analyzed build. - **Data Sharing:** 80/100. Data is shared with a defined set of service providers for analytics, marketing, authentication, and payment processing. No SDK serving display advertisements to users was found in this build; ad-related permissions appear tied to attribution and analytics functions rather than ad delivery. - **User Control:** 72/100. The developer's Google Play listing states users can request data deletion. Analytics services in this build appear configured to initialize without a pre-launch consent step, which may limit a user's ability to opt out before behavioral data is sent to third parties. ## Positive Security Features - Login session data is stored using hardware-backed encryption, keeping it on the device and inaccessible to other apps. - The login flow uses a browser-based approach with a secure code-exchange verification step, avoiding the practice of handling account login information inside the app itself. - Device integrity and tamper detection are implemented via dedicated libraries. - No SDK serving display advertisements to users was found in this build; ad-related permissions in the manifest appear limited to attribution and analytics purposes. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Analytics consent timing** Google Play's data safety section (retrieved 2026-08-11) states the app may share location and personal information with third parties. The analyzed build links RudderStack, Salesforce Marketing Cloud, and Pendo in configurations that appear to initialize data collection at launch. Google's developer policies recommend presenting collection disclosures before data is gathered; whether server-side consent controls satisfy this requirement could not be determined from the binary alone. 2. **Advertising permissions scope** The AndroidManifest.xml in this build declares all four Android Privacy Sandbox advertising permissions, including the Protected Audience API permission for interest-group behavioral targeting. Google Play's published Privacy Sandbox guidance notes these permissions are intended for advertising-supported apps. GoodLeap Home's Play Store listing does not describe an advertising model, so a reader comparing the manifest against the store listing would find this combination unexpected for a financial services app. ### Security Enhancements 1. **Authentication secret management** Industry practice for mobile applications recommends that machine-to-machine authentication secrets be held server-side rather than bundled in the distributed app. Moving these secrets to a backend service would prevent recovery from downloaded app files. 2. **Build artifact scope** This production build bundles development and sandbox environment configuration files alongside production configuration. Restricting the release build to production-environment assets only would reduce exposure of internal service configuration. 3. **Network communication encryption** Removing the cleartext HTTP permission for the specific server address in the network security configuration would ensure all network communication in the app remains encrypted in transit. ## Technical Context **App Type:** Financial services - home loan management and solar monitoring **Classes Analyzed:** 25,413 **Third-Party Services:** 19 identified **Context Tags:** financial, sensitive_data, ads, location, contacts --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** GoodLeap, LLC **Version:** 1.6.5 (Build 232) **Analysis Date:** 2026-08-12 **Package:** com.goodleap.homeowner ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 1.6.5 analyzed on 2026-08-12 - May not reflect server-side security controls - Cannot detect all runtime behaviors