# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Critical issue. Has a high-severity open item in this area, detailed below. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Norton360 Antivirus & Security ## What This Means for You The analyzed build initializes Singular and Adobe analytics with Norton account identity on startup; the Play Store data safety label at the time of analysis declared no third-party data sharing. ## Recommendation: Use With Caution Build 26.14.0 delivers genuine on-device protection through malware scanning, scam call filtering, Wi-Fi threat detection, and dark web monitoring. The same build links Singular attribution and Adobe AEP Analytics, passing Norton account user ID to those services on app start based on code paths in this analysis, while the Play Store label at the time of analysis declared no third-party data sharing occurs. The build's network configuration also globally permits unencrypted HTTP for traffic outside Norton and Symantec domains, which was not runtime-tested but may affect how third-party SDK traffic travels. **Best For:** People who want on-device malware scanning, scam protection, dark web monitoring, and Wi-Fi security checks for their Android device. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security** - 0 findings **Network Security** - 2 findings (2 medium) **Code Safety** - 7 findings (1 critical, 1 high, 4 medium, 1 low) **Privacy** - 3 findings (2 high, 1 low) ## Privacy Concerns ### What Leaves the Device - Norton account user ID and advertising identifiers (Google Advertising ID, Android ID, App Set ID): the build initializes Singular attribution on startup with these identifiers, based on code paths found in this analysis; runtime transmission was not observed. - Product usage events: the build links Adobe AEP Analytics and routes events to Adobe's infrastructure; the specific data included in those events could not be confirmed from the binary without runtime testing. - Device session identifiers: the build links Avast Burger Analytics and Avast Shepherd Telemetry; what is included in payloads to those services could not be confirmed from the binary without runtime testing. ### What Stays on the Device - Installed application list: the build reads the full list of installed apps on the device for malware scanning and device integrity checks. No remote transmission of this list was found in the analyzed build; processing appears on-device only. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Singular - attribution and install analytics - Adobe AEP Analytics - product usage and event analytics - Firebase Analytics / Firebase Crashlytics / Firebase Performance - app analytics and stability reporting - Avast Burger Analytics - device session analytics - Avast Shepherd Telemetry - product event telemetry - Hiya - caller identification and spam call detection - Stripe - in-app payment processing - Plaid - bank account linking for financial monitoring - Auth0 - authentication infrastructure - Google Play Billing - in-app purchase processing ## Understanding the Scores **Security:** 65/100 **Privacy:** 73/100 ### Security Breakdown - **Data Security:** 89/100. Account data and session information are stored in hardware-backed encrypted storage across the build. Backup paths are excluded from the build, preventing stored data from being extracted via Android backup mechanisms. - **Network Security:** 78/100. First-party Norton and Symantec domains are configured for HTTPS-only connections. The build's global network configuration permits unencrypted HTTP for all other traffic, which was not runtime-tested. - **Code Safety:** 74/100. The build contains a static signing key embedded in a configuration file used to authenticate requests to the Norton login API, and includes several broadly accessible exported components. Standard input handling and memory safety practices are in place across the rest of the build. ### Privacy Breakdown - **Data Collection:** 71/100. The build requests broad device permissions including contacts, SMS, call log, location, and camera. The installed application list is read on-device for malware scanning, with no evidence of remote transmission found in this analysis. - **Data Sharing:** 75/100. Multiple analytics and telemetry services are linked in the binary. The Play Store data safety label at the time of analysis stated no third-party data sharing, which differs from the SDK links found in the build. - **User Control:** 76/100. Account deletion and subscription management are available via Google Play. Data-sharing preferences within the build could not be fully assessed from static analysis alone. ## Positive Security Features - Account data and session information are stored in hardware-backed encrypted storage, unavailable to other apps and to backup systems. - Device backup is disabled across the full build, preventing extraction of stored data via Android backup or Google Cloud Backup. - VPN login data is stored in a separate hardware-backed encrypted store with its own protected master key. - Wi-Fi security scanning validates network certificates against the device's trusted certificate store, providing a genuine basis for detecting insecure or tampered network connections. - The installed application list is processed entirely on the device for malware scanning; no evidence of remote transmission of this list was found in the analyzed build. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Third-party data sharing disclosure** The Play Store data safety label at the time of analysis (retrieved August 2026) stated "No data shared with third parties." The analyzed build links Singular, Adobe AEP Analytics, Avast Burger Analytics, and Avast Shepherd Telemetry, each initialized with device or account identifiers based on code paths in this build. Google Play's developer guidance defines data sharing as transmitting user data to a third party for the third party's own purposes, with exceptions for service providers acting on the developer's behalf. Whether those flows occur in practice, and whether the developer's categorization of these SDKs falls within the service-provider exception, could not be determined from the binary alone. 2. **Transit encryption disclosure** The Play Store data safety label at the time of analysis stated "Data is encrypted in transit." The build's network security configuration globally permits unencrypted HTTP for all traffic outside Norton and Symantec domains. Whether unencrypted connections are made at runtime could not be determined from the binary. ### Security Enhancements 1. **Authentication signing key management** The build embeds a static signing key in an assets configuration file used to generate authentication signatures for the Norton login API. Managing this key outside the app binary, for example via a server-side signing proxy or hardware-attested key issuance, would prevent it from being extracted from the build. 2. **Financial flow access restriction** The bank account-linking activity accepts incoming navigation without verifying the triggering app's identity via Android App Links. Adding App Link verification would restrict which apps may trigger the authenticated bank account-linking flow. 3. **Production build cleanup** The production build includes development and testing framework components that have no user-facing purpose. Excluding these from the release build would reduce unnecessary exposed surface area. 4. **Purchase interface origin validation** The in-app purchase interface uses an unanchored domain pattern for its origin check. A fully anchored pattern would more precisely restrict which pages may interact with the purchase interface. ## Technical Context **App Type:** Mobile security and identity protection **Classes Analyzed:** 39,600 **Third-Party Services:** 21 **Context Tags:** security, financial, sensitive_data, ads, contacts --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Gen Digital Inc. **Version:** 26.14.0.260729697 **Analysis Date:** 2026-08-12 **Package:** com.symantec.mobilesecurity ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 26.14.0.260729697 analyzed on 2026-08-12 - May not reflect server-side security controls - Cannot detect all runtime behaviors