fix: last 2.0.0 security items and public docs - #42
Merged
Merged
Conversation
- The PIN is a wiped CharArray on the PIN change screen, in the settings checks and in backup re-authentication (#21) - One biometric prompt at a time on the lock screen and the settings switch; a prompt lost to activity recreation no longer leaves the fingerprint button stuck, and a late answer is dropped (#7, #13) - Tests: Back on the lock screen, recreation during a prompt, FLAG_SECURE after onCreate and recreation, and a scan that fails on share intents, notifications, alarms or clipboard writes outside SensitiveClip (#13, #15, #16) - Docs: the auto-lock delay in SECURITY.md, the FAQ, the store listing and README (#9); note links documented as a deliberate exception (#25); biometric toggle policy; README crypto overview brought up to date
README, SECURITY, PRIVACY, CONTRIBUTING, the architecture notes and the bug report template now match the shipped app: auto-lock delay, Keystore-bound PIN, the danger-zone erase, the permissions actually requested, and where Ko-fi appears. CHANGELOG 2.0.0 is written for the public and dated 2026-09-25.
Selected text can be copied too, and every copy is marked sensitive and cleared after about a minute.
The focused block drew a 2 dp primary frame. The caret marks focus now; the block padding is unchanged, so text does not move.
Coverage (core/security)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
CharArrayon the PIN change screen, in the settings checks and in backup re-authentication.FLAG_SECUREafteronCreateand after recreation;SensitiveClip.main.Why
These are the last open items before tagging v2.0.0 and making the repository public.
Testing
spotlessApply detekt testFdroidDebugUnitTest assembleFdroidDebug assembleFdroidRelease: 972 tests, 0 failures.assembleFdroidDebugwithout any secrets.Not verified: the biometric changes on a device; they are covered by Robolectric tests only.
References
Closes #7, #9, #13, #15, #16, #17, #21, #25 (already closed with notes).