fix(android): keep the API bearer token out of device backups#1306
Open
sh1nj1 wants to merge 1 commit into
Open
fix(android): keep the API bearer token out of device backups#1306sh1nj1 wants to merge 1 commit into
sh1nj1 wants to merge 1 commit into
Conversation
The voice companion stores its Doorkeeper bearer token — which grants full mobile-API access to the user's Collavre account — in the collavre_voice Preferences DataStore. That file is app-private but plaintext, and the manifest shipped with allowBackup="true" (the default), so Android Auto Backup and adb backup could exfiltrate the token in cleartext (CWE-312, OWASP MASVS-STORAGE-2). Set allowBackup="false" to block Auto Backup / adb backup on all versions, and add dataExtractionRules excluding the file/sharedpref/database domains so a device-to-device transfer on Android 12+ (governed separately from allowBackup) also can't copy the token.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Daily code scan finding (code-scan-2026-06-15) on the freshly merged Voice Companion (#1297). The Android companion stores its Doorkeeper bearer token — which grants full mobile-API access to the user's Collavre account (approve/deny permission prompts, post comments as the user, register devices) — in the
collavre_voicePreferences DataStore (SettingsRepository). That file is app-private but plaintext, and the manifest shipped withandroid:allowBackup="true"(the platform default).That combination means Android Auto Backup (uploads app-private files to the user's cloud) and
adb backupcan exfiltrate the token in cleartext — a credential-at-rest exposure (CWE-312 Cleartext Storage of Sensitive Information, OWASP MASVS-STORAGE-2 no sensitive data in backups).Fix
android:allowBackup="false"— blocks Auto Backup andadb backupon all API levels.android:dataExtractionRulesexcluding thefile/sharedpref/databasedomains. On Android 12+ (this app targets SDK 34), backup and device-to-device transfer are governed separately fromallowBackup, so without this a D2D migration could still copy the token. The DataStore lives in thefiledomain, so it is now excluded from both channels.Scope / risk
Manifest + one new XML resource only. No Kotlin, no server code, no test impact. Loses cloud backup of the handful of non-sensitive UI prefs (TTS rate, locale) — an acceptable trade since they all live in the same single datastore as the token and can't be excluded at sub-file granularity.
Follow-up (not in this PR)
A defense-in-depth hardening would move the token specifically into
EncryptedSharedPreferences/ a Keystore-backed key so it is encrypted at rest even within the app sandbox. Left as a follow-up to keep this fix minimal and unambiguous.