# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## LinkedIn ## What This Means for You Contact data including postal addresses and social profiles is sent to LinkedIn's servers for connection suggestions, as stated in this build's permission request. Attribution data and advertising identifiers are shared with third parties for campaign measurement. ## Recommendation: Trustworthy CITT assesses this build Trustworthy for professional users. The binary links strong encryption for all LinkedIn API traffic, stores login credentials in the most secure iOS Keychain protection class, and implements Apple App Attest for server-side integrity verification. Contact data sharing for connection suggestions is disclosed in the permission request, and users who decline the contact permission are not affected by that disclosure. **Best For:** People who use LinkedIn for career development, job searching, and professional networking. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 0 findings **Network Security:** 3 findings (3 medium) **Code Safety:** 3 findings (3 low) **Privacy:** 1 finding (1 low) ## Privacy Concerns ### What Leaves the Device - Contact data (name, email, phone, employer, postal address, social profiles, and instant-message handles): sent to LinkedIn's servers when contact sync is enabled, per this build's stated permission disclosure - Attribution signals may be shared with Singular for install and campaign measurement, based on the attribution service linked in the binary - Crash and diagnostic data may be sent to Crashlytics (Firebase), which is linked in the binary ### What Stays on the Device No sensitive data was identified as processed only on the device. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Singular - install attribution and campaign measurement - Apple AdServices - attribution for App Store ad campaigns - Apple AdSupport - advertising identifier framework linked in the binary - Crashlytics (Firebase) - crash reporting and diagnostics - Firebase App Check - app integrity verification - Qualtrics XM - in-app user research and surveys - Microsoft (AzureCommunicationCalling, WalletLibrary) - video calling and digital identity verification - Persona2 - identity verification - Google (Sign-In, GoogleUtilities) - authentication and single sign-on ## Understanding the Scores **Security:** 84/100 **Privacy:** 86/100 ### Security Breakdown - **Data Security:** 91/100. Login credentials are stored in the most secure iOS Keychain protection class, tied to the device and requiring the device passcode. Apple App Attest is implemented, allowing servers to verify the binary is genuine before permitting sensitive operations. - **Network Security:** 76/100. LinkedIn API traffic uses HTTPS throughout the binary. The transport security configuration permits unencrypted connections across the entire app without per-domain restrictions, which may affect in-app browser flows including identity verification and offsite job applications. - **Code Safety:** 95/100. Strong implementation practices are present throughout the binary. Cryptographic operations rely on Apple's built-in security libraries with no custom implementations found. ### Privacy Breakdown - **Data Collection:** 86/100. Contact sync is explicitly disclosed in this build's permission request. The binary links contact field keys for postal addresses, social profiles, and instant-message handles in addition to name, email, and phone. - **Data Sharing:** 91/100. Attribution and identifier sharing is standard for an App Store application. No external consumer advertising network SDK is present in this build; advertising infrastructure is LinkedIn's own. - **User Control:** 88/100. Face ID biometric lock is available for an additional account access protection layer. Contact sync is permission-gated, and users who decline the permission are not affected by the contact upload disclosure. ## Positive Security Features - LinkedIn API traffic uses HTTPS throughout the binary; no cleartext first-party connections were found. - Login credentials are stored using the most secure iOS Keychain protection class, requiring the device passcode and tied to this device only. - Apple App Attest is implemented, allowing servers to verify the app binary is genuine before permitting sensitive operations. - Strong encryption is implemented using Apple's built-in security libraries with no custom cryptographic implementations found in the binary. - Face ID biometric app lock is available for an additional account access protection layer. - No external consumer advertising network SDK is present in this build; advertising infrastructure is LinkedIn's own. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Transport Security Scope** Apple's App Transport Security documentation recommends scoping any exceptions to the specific domains that require them. Info.plist in this build sets a global unrestricted transport configuration with no per-domain exceptions, removing enforcement across the entire app including in-app browser flows. Whether server-side redirect controls or other mitigations compensate for this was not tested. 2. **Contact Field Breadth** The permission request in this build states that contacts are uploaded to LinkedIn's servers for connection suggestions. The binary links contact field keys for postal addresses, social profiles, and instant-message handles beyond name, email, and phone. Whether this extended scope is reflected in the App Store privacy label could not be determined from the binary alone. 3. **App Privacy Manifest** Apple's guidance recommends including an app privacy manifest to document data types and system API usage. The main binary in this build does not include one. Adding it could make the App Store privacy label more complete. This is an optional enhancement. ### Security Enhancements 1. **Per-Domain Transport Security Scoping** Adding per-domain exception entries for the specific third-party services that require unencrypted connections would reduce the surface area for content injection into in-app browser flows. 2. **Origin Validation for In-App Browser Message Handlers** The identity-verification in-app browser in this build processes JavaScript messages from third-party providers. Adding validation of the originating page's security origin before dispatching those messages would reduce the risk of injected content triggering internal navigation. ## Technical Context **App Type:** Professional networking - high sensitivity (contacts, identity verification, career data) **Classes Analyzed:** 12 **Third-Party Services:** 20 **Context Tags:** social, contacts, ads, sensitive_data, camera --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** LinkedIn Corporation **Version:** 2026.0805.1140 (Build 9.32.2755) **Analysis Date:** 2026-08-13 **Package:** com.linkedin.LinkedIn ### Analysis Limitations - Static analysis only (code review without running the app) - Based on iOS binary version 2026.0805.1140 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors