# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## United Airlines ## What This Means for You Build 4.2.91 stores boarding passes and MileagePlus account PINs in a local database without on-device encryption, and analytics and session-recording services are configured to initialize before a user consent prompt is reached in the app's startup sequence. ## Recommendation: Solid Build 4.2.91 protects account sign-in data with hardware-backed device security while storing boarding passes, MileagePlus account numbers, and user PINs in a local database without on-device encryption. Analytics and session-recording services are configured to start before a consent gate is active in the app's startup sequence. Suitable for frequent United travelers who prioritize integrated booking, check-in, and inflight services and accept these security tradeoffs. **Best For:** Frequent United flyers who want flight booking, check-in, boarding passes, bag tracking, and inflight services in a single app. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 3 findings (1 high, 2 medium) **Network Security:** 2 findings (1 medium, 1 low) **Code Safety:** 5 findings (2 medium, 3 low) **Privacy:** 0 findings ## Privacy Concerns ### What Leaves the Device - Travel booking and account data: sent to United Airlines servers as the core function of flight booking, check-in, and account management - App usage and behavioral event data: shared with multiple analytics vendors including Quantum Metric, Kochava, Mixpanel, and Snowplow for measurement and attribution - Session activity recordings: may be shared with Quantum Metric; the SDK is configured to initialize before a user consent prompt is reached, and the SDK's published documentation describes session capture functionality - Location information: may be shared with Radar.io for airport and trip features when location permission has been granted and an active trip is in progress - Device identifiers: may be shared with analytics and attribution services as part of event data streams ### What Stays on the Device - Boarding passes: cached locally for offline access during travel - Flight status, gate information, and connection details: stored on the device for in-trip reference ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Quantum Metric - session recording and behavioral analytics - Kochava - marketing attribution and install measurement - Google (Firebase) - push notifications and analytics - Google Mobile Ads - advertising - Mixpanel - behavioral analytics - Snowplow - event analytics - Datadog - app performance monitoring - Radar.io - location-based airport and trip features - Netomi - in-app customer support chat - Qualtrics - in-app surveys and feedback - Microsoft Azure / Cognitive Services - cloud and voice features - CardinalCommerce - payment security verification - Uplift - buy-now-pay-later payment option - Jumio Netverify - identity verification - CarTrawler - car rental integration - Lyft - ground transportation integration - PingIdentity PingOne - identity and access management ## Understanding the Scores **Security:** 76/100 **Privacy:** 74/100 ### Security Breakdown - **Data Security:** 50/100. Build 4.2.91's local database stores boarding passes, MileagePlus account numbers, and user PINs without on-device encryption. An encryption implementation used to protect account profile fields uses a fixed parameter that reduces its effectiveness, and payment card data encryption relies on a remote configuration flag to select the stronger of two available schemes. - **Network Security:** 82/100. The build correctly handles connection errors across its backend calls. A configuration exception permits unencrypted connections to seven aircraft inflight entertainment network hosts, including for content licensing key requests on the shared cabin network. - **Code Safety:** 85/100. Hardware-backed key storage protects account sign-in data and developer backup access is disabled across 63,786 analyzed classes. Payment return link handlers accept callbacks based on link scheme alone without source verification, and the Chase credit card web screen exposes broader native functionality than the interaction requires, accessible to the web content it displays. ### Privacy Breakdown - **Data Collection:** 80/100. Core travel data including bookings, check-in information, and bag tracking is gathered as expected for airline app functionality. Multiple concurrent analytics services receive behavioral event streams and usage data. - **Data Sharing:** 86/100. Data sharing covers United's airline partners, payment processors, and a named set of analytics and attribution services. No data broker sharing was identified in this build. - **User Control:** 80/100. The Google Play listing includes a data deletion request option. Background location access is gated on an explicit system permission grant and an active trip condition in the app's code. ## Positive Security Features - Account sign-in sessions, flight status data, and bag tracking information are protected with hardware-backed encryption that ties the security keys to this specific device - Developer backup access is disabled, preventing app data from being read through Android's standard backup channels - Background location access requires an explicit system permission grant and an active trip condition in the app's code; location is not requested during general app browsing based on this build - Secure connection errors are correctly rejected across the app's backend calls, with no unsafe override patterns found in this build ## Areas for Improvement ### Disclosure observations The Google Play Store Data Safety label (retrieved August 2026) declares that the app may share Personal info with third parties and may collect Location, Personal info, and 8 other data categories. Build 4.2.91 links analytics and attribution SDKs including Quantum Metric, Kochava, Mixpanel, Snowplow, and Datadog, each of which may receive independent event streams. Google's Data Safety guidance asks developers to itemize all data flows through bundled third-party libraries; comparing the label against the linked SDKs may reveal areas worth clarifying. ### Security Enhancements 1. **Local database protection** The local database holding boarding passes, MileagePlus account numbers, and user PINs could be strengthened by enabling on-device database encryption, which would limit exposure if the device is accessed without authorization. 2. **Payment card encryption consistency** The build defaults to an older padding scheme for payment card data when a remote configuration flag is absent. Using the stronger scheme that the app already applies in other areas as the unconditional default would remove the dependency on runtime flag state. 3. **Inflight entertainment connection security** Build 4.2.91 contains configuration permitting unencrypted connections to seven aircraft network hosts, including for content licensing key requests. Configuring encrypted connections for these hosts would reduce the exposure window on shared cabin Wi-Fi networks. 4. **Chase agreement document storage** Credit card agreement documents written as part of the Chase credit card flow are saved to a storage location readable by other installed apps using standard Android media access. Saving these files to the app's private storage would limit access. 5. **Payment return link validation** The payment return link handlers accept callbacks based on the link scheme alone, without source verification. Adding a state verification step to these handlers would reduce the risk of forged callback invocations. ## Technical Context **App Type:** Travel and financial (airline booking, payments, inflight services) **Classes Analyzed:** 63,786 **Third-Party Services:** 29 identified **Context Tags:** financial, travel, location, ads, sensitive_data --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** United Airlines, Inc. **Version:** 4.2.91 (Build 3611) **Analysis Date:** 2026-08-13 **Package:** com.united.mobile.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 4.2.91 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors