# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## X ## What This Means for You X builds on strong direct message encryption and excludes all app data from cloud backup, while the binary links Google AdMob code designed to read the advertising identifier alongside a Play Store data safety label that declares no third-party data sharing. ## Recommendation: Trustworthy CITT rates X Trustworthy at 82/100. The build incorporates meaningful security foundations: direct message encryption uses XChaCha20-Poly1305, app data is excluded from cloud backup, account sign-in data is stored in Android's OS-level account manager, and domain validation is configured for core streaming connections. The binary also links Google AdMob alongside a Play Store data safety label that declares no third-party data sharing, a point of comparison between the binary evidence and the published disclosure. **Best For:** People seeking real-time news, breaking events, live audio spaces, and public conversation on a global social platform. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 low) **Network Security:** 2 findings (1 medium, 1 low) **Code Safety:** 6 findings (3 medium, 3 low) **Privacy:** 2 findings (1 medium, 1 low) ## Privacy Concerns ### What Leaves the Device - Advertising identifier: the binary includes Google AdMob code designed to read the Google Advertising ID and may send ad measurement signals to Google's infrastructure. - Behavioral and location signals: the Castle Highwind fraud detection SDK in this build registers continuous sensor listeners (accelerometer, gyroscope, location) and may send device signals to Castle's servers. - Analytics and crash data: the binary includes Google Firebase Analytics and Google Firebase Crashlytics code, which may send usage signals and crash diagnostics to Google's servers. - Payment and financial data: the binary includes Stripe, Plaid, and Pinwheel integrations for payments and financial account linking, which may process relevant financial information with those services. - Identity verification data: the binary includes the Socure identity verification SDK, which may send document and identity signals to Socure's servers when identity verification is initiated. ### What Stays on the Device - Camera frames captured during identity document verification are processed using on-device machine learning models; the code does not route intermediate frames off the device. - The list of installed apps used for the share feature is evaluated on the device; the code does not route this list to remote servers. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google (AdMob, Firebase Analytics, Crashlytics, Cloud Messaging, Maps) - advertising, analytics, crash reporting, notifications, and mapping - Castle (Highwind SDK) - behavioral fraud detection - Sardine AI - fraud detection - Branch.io - app attribution - Datadog - performance monitoring - Stripe - payment processing - Plaid - financial account linking - Pinwheel - financial data access - Socure - identity document verification - Auth0 - authentication services - LiveKit - live audio and video streaming ## Understanding the Scores **Security:** 85/100 **Privacy:** 80/100 ### Security Breakdown - **Data Security:** 83/100. The build links strong cryptographic tools for direct message encryption and stores account sign-in data at the OS level. A low-severity configuration was identified involving media downloads written to a shared storage location that other apps may read on older Android versions. - **Network Security:** 87/100. The build's network configuration permits unencrypted HTTP connections app-wide, which means third-party libraries in the build could issue unencrypted requests without being blocked. Core X API connections are directed to encrypted channels. - **Code Safety:** 82/100. The build includes several security-oriented components. A debug HTTP inspector library was pulled from a dependency rather than its production no-op form; it is not wired into traffic capture in this build. Several in-app browser components are configured with broad domain patterns that could be tightened. ### Privacy Breakdown - **Data Collection:** 82/100. The binary links analytics, advertising, and fraud detection services that may send usage signals off the device. Camera frames during identity verification and the installed-app list for sharing are both processed on the device; the code does not route them to remote servers. - **Data Sharing:** 86/100. Data sharing is directed primarily toward functional purposes: payments, fraud prevention, push notifications, and attribution. The advertising data flow is limited to the advertising identifier. - **User Control:** 85/100. The Play Store lists data deletion as available. The build links account management functionality aligned with that capability. ## Positive Security Features - Direct message encryption uses XChaCha20-Poly1305, the same cryptographic foundation used by Signal and WhatsApp. - All app data is excluded from cloud backup, so a compromised cloud account cannot retrieve stored messages, sign-in data, or encryption keys. - Account sign-in data is stored in Android's OS-level account manager rather than application-level storage. - Domain validation is configured for X and Periscope streaming connections, reducing exposure to rogue certificate attacks. - The SMS one-time code auto-read feature extracts only the numeric code with no full message body access. - The build includes multiple layers of tamper detection and integrity checking, including Play Integrity attestation. - Camera frames processed during identity document capture remain on the device via on-device machine learning models; the code does not route intermediate frames off the device. - The installed-app list used for the share feature is evaluated on the device; the code does not route this list to remote servers. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Advertising data flow and the Play Store data safety label** Google's Data Safety policy requires developers to declare data shared with third parties, including advertising SDKs operated by companies other than the developer. The Play Store data safety label for this app (retrieved 2026-08-12) states "No data shared with third parties." The binary links Google AdMob; the AdMob SDK is designed to read the Google Advertising ID and connect to Google's ad measurement infrastructure. Google (which operates AdMob) is a company separate from X Corp. CITT makes no compliance determination; readers can compare the label and the binary evidence above. 2. **Castle fraud detection SDK and the Play Store data safety label** The Castle Highwind SDK is present in the binary and is designed to read device sensor data and location signals and may send those signals to Castle's servers. The Play Store data safety label (retrieved 2026-08-12) does not list Castle as a data recipient. CITT makes no compliance determination; the binary evidence is noted so readers can compare. ### Security Enhancements 1. **Restrict network connections to encrypted channels** The build-level network configuration permits unencrypted HTTP app-wide. A network security configuration that restricts connections to HTTPS, with narrowly defined exceptions, would reduce the risk of third-party components making unencrypted requests. 2. **Replace the debug HTTP inspector library with its production no-op** The full debug variant of the Chucker HTTP inspector library was included from a build dependency. Replacing it with the production no-op variant would reduce unnecessary build surface. 3. **Scope media downloads to app-private storage** Downloaded media and direct message attachments are written to the public Downloads folder. On Android 9 and below (this build's minimum supported version), other apps with the shared storage permission may read those files. Writing to app-private storage would prevent that exposure. ## Technical Context **App Type:** Social media and real-time news platform (Mature 17+, contains ads and in-app purchases) **Classes Analyzed:** 189,483 **Third-Party Services:** 24 identified **Context Tags:** social, ads, financial, sensitive_data, location, camera --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** X Corp. **Version:** 12.15.2-release.0 **Analysis Date:** 2026-08-13 **Package:** com.twitter.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 12.15.2-release.0 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors