carp-dk / carp-dk/carp_study_app
fix(privacy): disable Android auto-backup for credentials (allowBackup/backup rules)
Open
- Dominant language
- Dart
- Stars
- 10
- Forks
- 5
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 14
Description
## Problem
(verified) The `` element sets no `android:allowBackup`/`dataExtractionRules` (`android/app/src/main/AndroidManifest.xml:100-101`), so the default backs up SharedPreferences — i.e., the plaintext tokens — to Google-managed backups.
## Proposed fix
`android:allowBackup="false"`, or `dataExtractionRules`/`fullBackupContent` excluding prefs and the cache dir if backup is wanted for anything else.
## Acceptance criteria
- [ ] `adb shell bmgr` backup/restore test shows no credential restoration
- [ ] Manifest decision documented
**Effort:** S · **Priority:** P1 · **Change risk:** Low
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.