@mmerterden/multi-agent-pipeline 20.1.0 → 20.2.1

package/pipeline/skills/shared/external/android-security/SKILL.md

@@ -9,9 +9,17 @@ Security patterns for Android apps covering data storage, network security,
 authentication, integrity verification, and obfuscation. Targets 2024-2025
 best practices with AndroidX Security, BiometricPrompt, and Play Integrity.
 
+Full code for every pattern below lives in
+[`references/patterns.md`](references/patterns.md), under headings that mirror
+these sections. This file is the guide: read a section for the decision, then
+load the matching reference section when writing the implementation.
+
 ## Contents
 
 - [Secure Data Storage](#secure-data-storage)
+- [Encrypted DataStore for Secrets](#encrypted-datastore-for-secrets)
+- [Database Key Hierarchy](#database-key-hierarchy)
+- [Build-Type Security Gating](#build-type-security-gating)
 - [Biometric Authentication](#biometric-authentication)
 - [Certificate Pinning](#certificate-pinning)
 - [API Key Protection](#api-key-protection)
@@ -26,225 +34,88 @@ best practices with AndroidX Security, BiometricPrompt, and Play Integrity.
 
 ## Secure Data Storage
 
-### EncryptedSharedPreferences
-
-For sensitive key-value data. Uses AES-256 encryption under the hood.
-
-```kotlin
-import androidx.security.crypto.EncryptedSharedPreferences
-import androidx.security.crypto.MasterKey
-
-class SecureStorage @Inject constructor(
-    @ApplicationContext private val context: Context,
-) {
-    private val masterKey = MasterKey.Builder(context)
-        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
-        .build()
-
-    private val prefs = EncryptedSharedPreferences.create(
-        context,
-        "secure_prefs",
-        masterKey,
-        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
-        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM,
-    )
-
-    fun saveToken(token: String) {
-        prefs.edit().putString("auth_token", token).apply()
-    }
-
-    fun getToken(): String? = prefs.getString("auth_token", null)
-
-    fun clearToken() {
-        prefs.edit().remove("auth_token").apply()
-    }
-
-    fun clearAll() {
-        prefs.edit().clear().apply()
-    }
-}
-```
+The Android Keystore holds cryptographic keys (hardware-backed, keys never leave
+the secure hardware). `EncryptedSharedPreferences` is deprecated: keep it only to
+read an existing store during migration, and route new key-value secrets through
+[Encrypted DataStore for Secrets](#encrypted-datastore-for-secrets).
 
-### Android Keystore
-
-For cryptographic key management. Keys never leave the hardware.
-
-```kotlin
-import java.security.KeyStore
-import javax.crypto.Cipher
-import javax.crypto.KeyGenerator
-import javax.crypto.SecretKey
-import javax.crypto.spec.GCMParameterSpec
-import android.security.keystore.KeyGenParameterSpec
-import android.security.keystore.KeyProperties
-
-class KeystoreManager {
-
-    companion object {
-        private const val KEYSTORE_PROVIDER = "AndroidKeyStore"
-        private const val KEY_ALIAS = "app_encryption_key"
-        private const val TRANSFORMATION = "AES/GCM/NoPadding"
-    }
-
-    private fun getOrCreateKey(): SecretKey {
-        val keyStore = KeyStore.getInstance(KEYSTORE_PROVIDER).apply { load(null) }
-
-        keyStore.getEntry(KEY_ALIAS, null)?.let { entry ->
-            return (entry as KeyStore.SecretKeyEntry).secretKey
-        }
-
-        val keyGenerator = KeyGenerator.getInstance(
-            KeyProperties.KEY_ALGORITHM_AES,
-            KEYSTORE_PROVIDER,
-        )
-
-        keyGenerator.init(
-            KeyGenParameterSpec.Builder(
-                KEY_ALIAS,
-                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT,
-            )
-            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
-            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
-            .setKeySize(256)
-            .setUserAuthenticationRequired(false)
-            .build()
-        )
-
-        return keyGenerator.generateKey()
-    }
-
-    fun encrypt(data: ByteArray): Pair<ByteArray, ByteArray> {
-        val cipher = Cipher.getInstance(TRANSFORMATION)
-        cipher.init(Cipher.ENCRYPT_MODE, getOrCreateKey())
-        val encrypted = cipher.doFinal(data)
-        return Pair(cipher.iv, encrypted)
-    }
-
-    fun decrypt(iv: ByteArray, encryptedData: ByteArray): ByteArray {
-        val cipher = Cipher.getInstance(TRANSFORMATION)
-        val spec = GCMParameterSpec(128, iv)
-        cipher.init(Cipher.DECRYPT_MODE, getOrCreateKey(), spec)
-        return cipher.doFinal(encryptedData)
-    }
-}
-```
+See `references/patterns.md` -> "Secure Data Storage" for the legacy
+`EncryptedSharedPreferences` reader and the `KeystoreManager` (encrypt/decrypt
+with a Keystore-held AES/GCM key) that the newer patterns build on.
 
 ### What Goes Where
 
 | Data Type | Storage | Why |
 |-----------|---------|-----|
-| Auth tokens | EncryptedSharedPreferences | Encrypted at rest, simple API |
+| Auth tokens | Encrypted DataStore (Keystore-backed serializer) | Typed, async, encrypted at the serializer layer |
 | Passwords | Android Keystore + encryption | Hardware-backed security |
 | API keys | BuildConfig (build-time injection) | Not in source; obfuscated by R8 |
-| User preferences (non-sensitive) | SharedPreferences / DataStore | No encryption needed |
+| Database passphrase | Envelope-wrapped by a Keystore key | Data key never persisted in the clear |
+| User preferences (non-sensitive) | Preferences DataStore | No encryption needed |
 | Large sensitive files | Encrypted file + Keystore key | AES encryption with hardware key |
 
-## Biometric Authentication
+## Encrypted DataStore for Secrets
 
-### BiometricPrompt Setup
+For typed key-value secrets, prefer a typed DataStore encrypted at the serializer
+layer over the deprecated `EncryptedSharedPreferences`. The delegate serializer
+produces plaintext bytes, a non-exportable Keystore AES/GCM key seals them (IV
+prepended), and only ciphertext reaches disk. This skill owns the security
+rationale and the key material; the DataStore mechanics (the `dataStore`
+delegate, `Flow` reads, `updateData` writes) belong to the `android-datastore`
+skill -- do not reproduce them here.
 
-```kotlin
-class BiometricAuthenticator @Inject constructor() {
-
-    fun authenticate(
-        activity: FragmentActivity,
-        title: String = "Authenticate",
-        subtitle: String = "Verify your identity",
-        onSuccess: () -> Unit,
-        onError: (String) -> Unit,
-    ) {
-        val biometricManager = BiometricManager.from(activity)
-        val canAuthenticate = biometricManager.canAuthenticate(
-            BiometricManager.Authenticators.BIOMETRIC_STRONG or
-            BiometricManager.Authenticators.DEVICE_CREDENTIAL
-        )
-
-        if (canAuthenticate != BiometricManager.BIOMETRIC_SUCCESS) {
-            onError(mapBiometricError(canAuthenticate))
-            return
-        }
-
-        val promptInfo = BiometricPrompt.PromptInfo.Builder()
-            .setTitle(title)
-            .setSubtitle(subtitle)
-            .setAllowedAuthenticators(
-                BiometricManager.Authenticators.BIOMETRIC_STRONG or
-                BiometricManager.Authenticators.DEVICE_CREDENTIAL
-            )
-            .build()
-
-        val callback = object : BiometricPrompt.AuthenticationCallback() {
-            override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
-                onSuccess()
-            }
-
-            override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
-                onError(errString.toString())
-            }
-
-            override fun onAuthenticationFailed() {
-                // Called on failed attempt but user can retry
-            }
-        }
-
-        val prompt = BiometricPrompt(activity, callback)
-        prompt.authenticate(promptInfo)
-    }
-
-    private fun mapBiometricError(code: Int): String = when (code) {
-        BiometricManager.BIOMETRIC_ERROR_NO_HARDWARE -> "No biometric hardware"
-        BiometricManager.BIOMETRIC_ERROR_HW_UNAVAILABLE -> "Biometric hardware unavailable"
-        BiometricManager.BIOMETRIC_ERROR_NONE_ENROLLED -> "No biometrics enrolled"
-        else -> "Biometric authentication unavailable"
-    }
-}
-```
+See `references/patterns.md` -> "Encrypted DataStore" for the `KeystoreCrypto`
+seal/open helpers and the `EncryptedSerializer<T>` that wraps a plaintext
+serializer.
 
-### Biometric + Keystore (Crypto-Based Auth)
+## Database Key Hierarchy
 
-```kotlin
-fun authenticateWithCrypto(
-    activity: FragmentActivity,
-    onSuccess: (Cipher) -> Unit,
-) {
-    val key = getOrCreateBiometricKey()
-    val cipher = Cipher.getInstance("AES/GCM/NoPadding")
-    cipher.init(Cipher.ENCRYPT_MODE, key)
-
-    val cryptoObject = BiometricPrompt.CryptoObject(cipher)
-
-    val prompt = BiometricPrompt(activity, object : BiometricPrompt.AuthenticationCallback() {
-        override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
-            result.cryptoObject?.cipher?.let(onSuccess)
-        }
-    })
-
-    prompt.authenticate(promptInfo, cryptoObject)
-}
-
-private fun getOrCreateBiometricKey(): SecretKey {
-    val keyGenerator = KeyGenerator.getInstance("AES", "AndroidKeyStore")
-    keyGenerator.init(
-        KeyGenParameterSpec.Builder("biometric_key",
-            KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
-            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
-            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
-            .setUserAuthenticationRequired(true)
-            .setInvalidatedByBiometricEnrollment(true)
-            .build()
-    )
-    return keyGenerator.generateKey()
-}
-```
+Protect a database passphrase with envelope encryption rather than storing it
+directly. Generate a random 32-byte data key, wrap it with a non-exportable
+AndroidKeystore AES/GCM key, and persist only the wrapped key plus its IV.
+Decrypt the data key just in time, hand it to the database, and zero the
+plaintext key bytes in a `finally` block once the database owns them. The
+SQLCipher `SupportFactory` wiring that consumes the passphrase lives in the
+`room-database` skill.
+
+See `references/patterns.md` -> "Database Key Hierarchy" for the
+`DatabaseKeyProvider` (wrap/unwrap against the Keystore) and the
+decrypt-then-zero consumer.
+
+## Build-Type Security Gating
+
+Decide certificate pinning and traffic inspection in one place, by build type.
+Pinning is production-only -- a debug proxy would fail the pins -- and the
+inspection and logging interceptors are debug-only, added last so they observe
+the final decorated request. Bind the debug interceptor set from a module in the
+`src/debug` source set and an empty set from `src/release`, so a release build
+cannot link the inspector at all.
+
+See `references/patterns.md` -> "Build-Type Security Gating" for the
+`OkHttpClientFactory` assembly and the paired `src/release` / `src/debug` Hilt
+modules.
+
+## Biometric Authentication
+
+Use `BiometricPrompt` with `BIOMETRIC_STRONG` for high-security flows. Always call
+`canAuthenticate()` first and map the result before showing the prompt. For flows
+that must prove a fresh authentication (unlocking a key), bind a `CryptoObject`
+backed by a Keystore key created with `setUserAuthenticationRequired(true)` and
+`setInvalidatedByBiometricEnrollment(true)`.
+
+See `references/patterns.md` -> "Biometric Authentication" for the
+`BiometricAuthenticator` setup (with error mapping) and the crypto-based
+`authenticateWithCrypto` variant.
 
 ## Certificate Pinning
 
-### OkHttp CertificatePinner
+Pin with OkHttp `CertificatePinner` or a Network Security Config XML. Include at
+least two pins (primary + backup) so certificate rotation does not brick clients.
 
 ```kotlin
 val certificatePinner = CertificatePinner.Builder()
-    .add("api.example.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=") // Primary
-    .add("api.example.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=") // Backup
+    .add("api.example.com", "sha256/AAAA...=") // Primary
+    .add("api.example.com", "sha256/BBBB...=") // Backup
     .build()
 
 val client = OkHttpClient.Builder()
@@ -252,79 +123,14 @@ val client = OkHttpClient.Builder()
     .build()
 ```
 
-### Generating Pin Hashes
-
-```bash
-# From a domain
-openssl s_client -connect api.example.com:443 -servername api.example.com \
-    | openssl x509 -pubkey -noout \
-    | openssl pkey -pubin -outform der \
-    | openssl dgst -sha256 -binary \
-    | openssl enc -base64
-
-# From a certificate file
-openssl x509 -in cert.pem -pubkey -noout \
-    | openssl pkey -pubin -outform der \
-    | openssl dgst -sha256 -binary \
-    | openssl enc -base64
-```
-
-### Network Security Config (XML-based)
-
-```xml
-<!-- res/xml/network_security_config.xml -->
-<?xml version="1.0" encoding="utf-8"?>
-<network-security-config>
-    <domain-config cleartextTrafficPermitted="false">
-        <domain includeSubdomains="true">api.example.com</domain>
-        <pin-set expiration="2026-01-01">
-            <pin digest="SHA-256">AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=</pin>
-            <pin digest="SHA-256">BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=</pin>
-        </pin-set>
-    </domain-config>
-
-    <!-- Block cleartext for all domains -->
-    <base-config cleartextTrafficPermitted="false" />
-</network-security-config>
-```
-
-```xml
-<!-- AndroidManifest.xml -->
-<application android:networkSecurityConfig="@xml/network_security_config">
-```
+See `references/patterns.md` -> "Certificate Pinning" for the `openssl` pin-hash
+generation commands and the equivalent `network_security_config.xml` `pin-set`.
 
 ## API Key Protection
 
-### local.properties (Gitignored)
-
-```properties
-# local.properties -- NEVER commit this file
-MAPS_API_KEY=AIzaSyB...
-BASE_URL=https://api.example.com/
-```
-
-### Build-Time Injection
-
-```kotlin
-// build.gradle.kts
-import java.util.Properties
-
-val localProperties = Properties().apply {
-    val file = rootProject.file("local.properties")
-    if (file.exists()) load(file.inputStream())
-}
-
-android {
-    defaultConfig {
-        buildConfigField("String", "MAPS_API_KEY",
-            "\"${localProperties["MAPS_API_KEY"] ?: ""}\"")
-        buildConfigField("String", "BASE_URL",
-            "\"${localProperties["BASE_URL"] ?: "https://api.example.com/"}\"")
-    }
-}
-```
-
-### Usage in Code
+Keep secrets out of source. Put them in gitignored `local.properties`, inject
+them at build time via `buildConfigField`, and read them from `BuildConfig` (R8
+obfuscates them in release builds).
 
 ```kotlin
 // Access via BuildConfig -- obfuscated by R8 in release builds
@@ -332,21 +138,9 @@ val apiKey = BuildConfig.MAPS_API_KEY
 val baseUrl = BuildConfig.BASE_URL
 ```
 
-### Manifest Placeholder
-
-```kotlin
-android {
-    defaultConfig {
-        manifestPlaceholders["MAPS_API_KEY"] = localProperties["MAPS_API_KEY"] ?: ""
-    }
-}
-```
-
-```xml
-<meta-data
-    android:name="com.google.android.geo.API_KEY"
-    android:value="${MAPS_API_KEY}" />
-```
+See `references/patterns.md` -> "API Key Protection" for the `local.properties`
+layout, the `build.gradle.kts` injection block, and the manifest-placeholder
+route for keys consumed from `AndroidManifest.xml`.
 
 ## R8 Obfuscation
 
@@ -356,127 +150,37 @@ R8 is enabled automatically when `isMinifyEnabled = true`. It performs:
 - Obfuscation (renames classes/methods)
 - Optimization (inlining, dead code elimination)
 
-### Mapping File
-
-R8 generates `mapping.txt` for deobfuscating crash reports:
-
-```kotlin
-android {
-    buildTypes {
-        release {
-            isMinifyEnabled = true
-            isShrinkResources = true
-            proguardFiles(
-                getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro",
-            )
-        }
-    }
-}
-```
+R8 generates `mapping.txt` for deobfuscating crash reports. Upload it to Google
+Play Console and Firebase Crashlytics for readable stack traces. Add `-keep`
+rules for `@Serializable` and other reflectively-accessed classes.
 
-Upload `mapping.txt` to Google Play Console and Firebase Crashlytics for
-readable stack traces.
+See `references/patterns.md` -> "R8 Obfuscation" for the release `buildTypes`
+block.
 
 ## Play Integrity API
 
-Verify that API requests come from a genuine app on a genuine device.
+Verify that API requests come from a genuine app on a genuine device. Request an
+integrity token on the client, then send it to your server. Never verify
+integrity tokens on the client -- the server must decode and validate them via
+the Play Integrity API.
 
-```kotlin
-class IntegrityVerifier @Inject constructor(
-    @ApplicationContext private val context: Context,
-) {
-    suspend fun getIntegrityToken(nonce: String): String? {
-        return try {
-            val integrityManager = IntegrityManagerFactory.create(context)
-
-            val request = IntegrityTokenRequest.builder()
-                .setNonce(nonce)
-                .build()
-
-            val response = integrityManager
-                .requestIntegrityToken(request)
-                .await()
-
-            response.token()
-        } catch (e: Exception) {
-            null
-        }
-    }
-}
-```
-
-Send the token to your server for verification. Never verify integrity tokens
-on the client -- the server must decode and validate them via the Play Integrity
-API.
+See `references/patterns.md` -> "Play Integrity API" for the `IntegrityVerifier`
+token request.
 
 ## Root Detection
 
 Root detection is defense-in-depth. Determined attackers can bypass it, but it
-raises the bar.
-
-```kotlin
-object RootDetector {
-
-    fun isDeviceRooted(): Boolean =
-        checkRootBinaries() || checkSuExists() || checkRootApps()
-
-    private fun checkRootBinaries(): Boolean {
-        val paths = listOf(
-            "/system/bin/su",
-            "/system/xbin/su",
-            "/sbin/su",
-            "/system/app/Superuser.apk",
-            "/system/app/SuperSU.apk",
-        )
-        return paths.any { File(it).exists() }
-    }
-
-    private fun checkSuExists(): Boolean = try {
-        Runtime.getRuntime().exec("which su").inputStream.bufferedReader().readLine() != null
-    } catch (e: Exception) {
-        false
-    }
-
-    private fun checkRootApps(): Boolean {
-        val rootPackages = listOf(
-            "com.topjohnwu.magisk",
-            "eu.chainfire.supersu",
-            "com.koushikdutta.superuser",
-        )
-        // Check if any are installed (requires QUERY_ALL_PACKAGES or specific queries)
-        return false // Simplified -- use PackageManager in production
-    }
-}
-```
+raises the bar. Use it as one signal among many and combine it with Play
+Integrity for stronger guarantees.
 
-Use root detection as one signal among many. Combine with Play Integrity for
-stronger guarantees.
+See `references/patterns.md` -> "Root Detection" for the `RootDetector` object
+(root binaries, `su` probe, known root packages).
 
 ## Secure Network Communication
 
-### Enforce HTTPS
-
-```xml
-<!-- network_security_config.xml -->
-<network-security-config>
-    <base-config cleartextTrafficPermitted="false" />
-</network-security-config>
-```
-
-### Debug-Only Cleartext (for local development)
-
-```xml
-<network-security-config>
-    <base-config cleartextTrafficPermitted="false" />
-    <domain-config cleartextTrafficPermitted="true">
-        <domain includeSubdomains="false">10.0.2.2</domain>
-        <domain includeSubdomains="false">localhost</domain>
-    </domain-config>
-</network-security-config>
-```
-
-### TLS Configuration
+Enforce HTTPS by setting `cleartextTrafficPermitted="false"` in the Network
+Security Config, add a debug-only cleartext exception for local dev hosts
+(`10.0.2.2`, `localhost`), and restrict TLS to 1.2/1.3.
 
 ```kotlin
 val spec = ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
@@ -488,49 +192,26 @@ val client = OkHttpClient.Builder()
     .build()
 ```
 
-## Secure Coding Patterns
-
-### Never Log Sensitive Data
-
-```kotlin
-// WRONG
-Log.d("Auth", "Token: $token")
-Log.d("Payment", "Card: $cardNumber")
-
-// CORRECT
-Log.d("Auth", "Token refresh successful")
-Log.d("Payment", "Payment processed")
-```
-
-### Input Validation
+See `references/patterns.md` -> "Secure Network Communication" for the HTTPS-only
+and debug-cleartext XML configs.
 
-```kotlin
-fun validateDeepLink(uri: Uri): Boolean {
-    val allowedHosts = setOf("example.com", "www.example.com")
-    val allowedSchemes = setOf("https")
-
-    return uri.scheme in allowedSchemes &&
-           uri.host in allowedHosts &&
-           !uri.path.orEmpty().contains("..")
-}
-```
+## Secure Coding Patterns
 
-### Secure WebView
+- Never log tokens, passwords, or card numbers -- log outcomes, not values.
+- Validate deep-link URIs: allow-list scheme and host, reject `..` paths.
+- Lock down WebView: disable JavaScript, file access, content access, and DOM
+  storage unless a feature strictly requires them.
 
-```kotlin
-webView.settings.apply {
-    javaScriptEnabled = false       // Enable ONLY if required
-    allowFileAccess = false
-    allowContentAccess = false
-    domStorageEnabled = false
-}
-```
+See `references/patterns.md` -> "Secure Coding Patterns" for the logging,
+`validateDeepLink`, and secure-WebView snippets.
 
 ## Do's and Don'ts
 
 ### Do's
-- Use EncryptedSharedPreferences for sensitive key-value data
+- Encrypt key-value secrets at the DataStore serializer layer with a Keystore key
 - Use Android Keystore for cryptographic keys
+- Envelope-wrap a database passphrase and zero the plaintext key after use
+- Gate certificate pinning and inspectors by build type in one place
 - Enable R8 with `isMinifyEnabled = true` for release builds
 - Upload `mapping.txt` to Play Console and Crashlytics
 - Use Network Security Config to enforce HTTPS
@@ -539,7 +220,9 @@ webView.settings.apply {
 - Use BiometricPrompt with BIOMETRIC_STRONG for high-security flows
 
 ### Don'ts
-- Do not store secrets in SharedPreferences (use EncryptedSharedPreferences)
+- Do not store secrets in plain SharedPreferences, or reach for the deprecated `EncryptedSharedPreferences` for new code
+- Do not persist a database passphrase or data key in the clear
+- Do not link a traffic inspector or body logging into release builds
 - Do not hardcode API keys in Kotlin/Java source files
 - Do not commit `local.properties` or keystore files to version control
 - Do not log tokens, passwords, or card numbers
@@ -553,7 +236,9 @@ webView.settings.apply {
 | Problem | Cause | Fix |
 |---------|-------|-----|
 | `KeyPermanentlyInvalidatedException` | Biometric enrollment changed | Delete and recreate the Keystore key |
-| EncryptedSharedPreferences crash on upgrade | MasterKey corrupted | Handle exception, recreate storage, re-authenticate user |
+| EncryptedSharedPreferences crash on upgrade | MasterKey corrupted | Migrate to encrypted DataStore; handle exception, recreate storage, re-authenticate |
+| Database fails to open after reinstall | Wrapping key lost with the Keystore; wrapped data key undecryptable | Treat encrypted data as unrecoverable; recreate the store and re-sync |
+| Debug proxy shows no traffic in release | Inspector correctly excluded from `src/release` | Expected; inspect on a debug build |
 | Certificate pinning fails after cert rotation | Pin hash mismatch | Update pins; always maintain a backup pin |
 | R8 strips serialization classes | Missing keep rules | Add `-keep` rules for `@Serializable` classes |
 | Play Integrity token is null | Missing Play Core dependency or not on Play device | Check `com.google.android.play:integrity` dependency |
@@ -563,7 +248,9 @@ webView.settings.apply {
 
 ## Review Checklist
 
-- [ ] Sensitive data in EncryptedSharedPreferences or Keystore, not plain SharedPreferences
+- [ ] Key-value secrets in a Keystore-backed encrypted DataStore, not plain or deprecated SharedPreferences
+- [ ] Database passphrase envelope-wrapped by a Keystore key; plaintext data key zeroed after use
+- [ ] Certificate pinning and inspectors gated by build type; no inspector in release
 - [ ] No hardcoded API keys or secrets in source files
 - [ ] `local.properties` is in `.gitignore`
 - [ ] R8 enabled with `isMinifyEnabled = true` for release