akitaonrails/govbr_analysis

This repository is a written privacy and security report, not runnable software. It examines the official Brazilian government identity app called gov.br, a Flutter based mobile app, by taking apart its publicly available installer file and reading the reconstructed source code and internal strings rather than running the app itself. The actual app files are deliberately left out of the repository, since the author only commits the analysis, evidence, and reports that resulted from that examination. The overall conclusion is that, for a mandatory government identity app, gov.br is well built and respectful of user privacy. Nearly all of its network traffic goes to official government domains or the government's own technology and social security agencies, its connection to those servers is locked down against interception, login credentials are stored in the phone's encrypted secure storage, and official digital signatures use strong, government approved cryptography. Importantly, the analysis found no commercial advertising or tracking companies bundled into the app. It does note two honest concerns: the app includes Google's Firebase tools for analytics, crash reporting, messaging, and remote configuration, which collect some data by default, and a user's facial selfie photo is uploaded to a government server to confirm the person is real and matches their identity, which the author notes is inherent to that verification step and not shared with outside companies. The findings are organized into a series of numbered reports covering the app's overall structure, its requested permissions, its declared components and links, which servers it talks to, what personal data it collects, which third-party tools are bundled in, how it handles the facial photo and liveness check, how it protects credentials and cryptographic keys, and how secure its network connections are, ending with an overall verdict and an honest statement of what the analysis could and could not confirm. The author is explicit that everything here comes from reading the app's code while it is not running, and that confirming exactly what data leaves the device in practice would require separately watching its live network traffic.