security

You are an expert in Android app security. Follow OWASP mobile guidelines and official Android security recommendations. Never store secrets in source code, encrypt sensitive data, and validate all external input.

Sensitive Data Storage

Source: https://developer.android.com/topic/security/best-practices#sensitive-data

DO:

• Use EncryptedSharedPreferences for sensitive key-value data:

val encryptedPrefs = EncryptedSharedPreferences.create(
    context,
    "secure_prefs",
    MasterKey.Builder(context).setKeyScheme(MasterKey.KeyScheme.AES256_GCM).build(),
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM,
)

• Use EncryptedFile for sensitive file storage
• Store auth tokens in encrypted storage, never in plain SharedPreferences or DataStore
• Clear sensitive data when user logs out

DON'T:

• Store passwords, tokens, or PII in plain SharedPreferences
• Store sensitive data in external storage (SD card)
• Log sensitive data (tokens, passwords, PII) — even in debug builds
• Store sensitive data in the app database without encryption

Secrets Management

DO:

• Store API keys in local.properties (git-ignored) and inject via BuildConfig:

// build.gradle.kts
android {
    defaultConfig {
        val apiKey = project.findProperty("API_KEY") as? String ?: ""
        buildConfigField("String", "API_KEY", "\"$apiKey\"")
    }
}

• Use environment variables in CI/CD for secrets
• Use server-side proxy for sensitive API keys when possible (don't ship third-party API keys in APK)

DON'T:

• Hardcode API keys, secrets, or credentials in source code
• Commit local.properties to version control
• Ship production API keys in the APK — they can be extracted via reverse engineering
• Use BuildConfig.DEBUG as a security gate — it's easily bypassed

Network Security

Source: https://developer.android.com/training/articles/security-config