gov.br — Privacy & Security Analysis
Static reverse-engineering privacy/security analysis of the official Brazilian government
digital-identity app gov.br (br.gov.meugovbr, v3.8.4 / build 226), a Flutter app.
APK source: gov.br_3.8.4_APKPure.xapk (APKPure; base + config.arm64_v8a + splits).
The .xapk/.apk/.so binaries and the unpacked/ + _work/ trees are gitignored;
this repo commits the reconstructed text, reports, and evidence only.
TL;DR
By the standards of a mandatory government identity app, gov.br is well-built and
privacy-respectful: data flows are almost entirely *.gov.br / SERPRO / Dataprev, TLS is
certificate-pinned, credentials sit in the encrypted Android KeyStore, ICP-Brasil signing uses
FIPS-grade crypto, and the app hardens hard against rooted/tampered devices. It contains no
commercial ad/attribution trackers — no Segment, Adjust, AppsFlyer, or Meta (correcting the
initial recon). The two honest caveats: it bundles Google Firebase (Analytics/Crashlytics/
Messaging/Remote Config/RTDB) with collection on by default and advertising-ID permissions
declared; and your facial selfie is uploaded to the government backend for identity matching
(inherent to "prova de vida", and gov-bound — not shared with third parties).
Everything here is static evidence. The top item to confirm on the wire is whether the CPF is attached to Google Crashlytics reports. See docs/10-assessment.md and docs/11-coverage.md.
Reports
| # | Report |
|---|---|
| — | docs/README.md — landing / citizen TL;DR / method |
| 01 | App overview — Flutter/TFLite/RSA inventory |
| 02 | Permissions — strict gov-context justification |
| 03 | Manifest & components — exports, deeplinks |
| 04 | Network endpoints — gov vs Google vs foreign |
| 05 | Data collection — CPF, location, device |
| 06 | Third-party SDKs — the tracker question |
| 07 | Biometrics & liveness — face data flow |
| 08 | Credential & key security — keystore/ICP |
| 09 | Transport & network security — pinning/cleartext |
| 10 | Assessment — verdict + dynamic follow-ups |
| 11 | Coverage — completeness & honesty statement |
Method (short)
Flutter app → logic is AOT Dart in libapp.so. Reconstructed with Blutter (Dart 3.7.2,
snapshot d91c0e6f35f0eb2e44124e8f42aa44a7); the build uses Dart name obfuscation, so string
constants (endpoints/headers/events) are the primary evidence, cross-checked against the jadx dex,
manifest, native .so strings, and flutter_assets. Full reproduce steps and blind spots in
docs/11-coverage.md.
Scope: defensive privacy/security assessment of a publicly distributed app. Findings describe built capability; confirming runtime data egress requires the dynamic capture described in the coverage report.
