# Security & Privacy Scorecard

## EICAR Virus Testing

EICAR Virus Testing is a single-purpose antivirus testing utility for Android, published by Montimage. It bundles inert EICAR standard test signatures so that antivirus engines can be triggered and verified on a device. It is designed exclusively for security professionals and developers who need a safe, controlled way to confirm that AV detection is working correctly.

## What This Means for You

When you run this app, your personal information stays entirely on your device, because it has no internet access and sends nothing to any server.

## Recommendation: Generally Safe

Legitimate antivirus testing tool for security professionals. No permissions, network access, or data collection. Antivirus alerts are expected and intentional - this is the app's intended purpose.

**Best For:** Security professionals and developers needing a safe AV detection test tool on Android

## Key Findings

**Data Security** - 0 findings

**Network Security** - 1 finding (1 info)

**Code Safety** - 1 finding (1 info)

**Privacy** - 1 finding (1 info)

## Privacy Concerns

### What Data is Collected

No data is collected by this app. It declares zero permissions in its manifest and contains no data-collection libraries of any kind.

### Third-Party Data Sharing

No third-party data sharing was identified in this analysis.

## Understanding the Scores

**Security:** 100/100
**Privacy:** 100/100

### Security Breakdown

- **Data Security:** 100/100 - No storage of sensitive data; app is limited to displaying bundled inert test files.
- **Network Security:** 100/100 - No internet permission declared; the OS blocks all outbound connections.
- **Code Safety:** 100/100 - Bundled EICAR test signatures are inert by design and contain no executable payload.

### Privacy Breakdown

- **Data Collection:** 100/100 - No personal, device, or usage data is collected.
- **Data Sharing:** 100/100 - No third-party SDKs, analytics providers, or ad networks are present.
- **User Control:** 100/100 - No permissions are requested, giving users full control over their device.

## Positive Security Features

- No network permissions declared - the app is completely isolated from the internet by the Android OS
- Zero third-party SDKs present - no analytics, advertising, crash-reporting, or attribution libraries
- No dangerous permissions of any kind requested in the app manifest
- Bundled EICAR test files are inert 68-byte signatures with no executable malicious payload
- Minimal code footprint with a single Flutter activity stub and no data-handling logic

## Areas for Improvement

### GDPR / CCPA Compliance

The app already follows strong data minimization practices. No improvements are needed: it collects no data, shares nothing with third parties, and requires no permissions.

### Security Enhancements

The app currently meets best-practice standards for its stated purpose. No security enhancements are required.

## Technical Context

**App Type:** Security testing utility (single-purpose, professional use)
**Classes Analyzed:** 180
**Third-Party Services:** None
**Context Tags:** testing

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Montimage
**Version:** 1.0.0 (build 1)
**Analysis Date:** 2026-04-15
**Package:** com.montimage.eicar_virus

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 1.0.0 analyzed on 2026-04-15
- May not reflect server-side security controls
- Cannot detect all runtime behaviors