Skip to content

Conversation

cpholguera
Copy link
Collaborator

@cpholguera cpholguera commented Jun 1, 2025

Closes #3123

This pull request updates documentation to improve guidance on securely handling sensitive data in Android apps. Key changes include emphasizing encryption for data storage, clarifying risks associated with backups and device compromise, and providing actionable recommendations for developers.

Enhancements to Data Storage Security Guidance:

  • Updated SharedPreferences section to highlight risks of storing sensitive data in plain text and recommended using EncryptedSharedPreferences for secure storage.
  • Added guidance on encrypting SQLite databases using libraries like SQLCipher, and outlined scenarios where unencrypted databases pose risks.

Backup and Device Security:

  • Revised backup section to explain how sensitive data in backups can be exposed and recommended excluding sensitive files from backups and encrypting data for protection.

File Permissions and App Vulnerabilities:

  • Clarified that modern Android apps (API 17+) have private file permissions by default, but sensitive data must still be encrypted to mitigate risks from rooted devices or backups. [1] [2]

Additional Recommendations:

  • Highlighted risks of app vulnerabilities (e.g., exposed content providers) and provided best practices for securely managing sensitive data, including using hardware-backed keystores and platform encryption APIs.

@cpholguera cpholguera marked this pull request as draft June 1, 2025 14:41
@cpholguera cpholguera changed the title Enhance documentation on sensitive data storage risks and mitigation strategies for Android applications Update sensitive data storage risks and mitigation strategies for Android apps Jun 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Clarifying recommendations on Android internal storage encryption
1 participant