Security: disable backup to protect stored credentials

[jdickey1]

Summary

• Set android:allowBackup="false" to prevent credential extraction via ADB backup
• Add backup_rules.xml and data_extraction_rules.xml as defense-in-depth

Problem

With allowBackup="true" and no backup exclusion rules, adb backup captures all SharedPreferences containing:

• Local server JWT secret and basic auth password
• Encryption passphrase
• Cloud gateway registration token
• FCM token

These can be restored to another device to impersonate the gateway.

Fix

1. Disable backup entirely (allowBackup="false")
2. Add fullBackupContent rules (Android 11 and below) excluding all SharedPreferences
3. Add dataExtractionRules (Android 12+) excluding SharedPreferences from both cloud backup and device transfer

The exclusion rules serve as defense-in-depth — if backup is re-enabled for other reasons, credentials remain protected.

Test plan

• Verify app builds successfully with the new XML resources
• Verify adb backup produces no usable SharedPreferences data
• Verify app functionality is unaffected (backup was never used for app features)

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• Bug Fixes
  • Modified backup configuration to exclude app settings and preferences from cloud backups and device-to-device data transfers.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5b2192f9-41fb-4b78-a775-d83b098cb153

📥 Commits

Reviewing files that changed from the base of the PR and between 4d6169b and 7b1be13.

📒 Files selected for processing (3)

• app/src/main/AndroidManifest.xml
• app/src/main/res/xml/backup_rules.xml
• app/src/main/res/xml/data_extraction_rules.xml

---

Walkthrough

The changes disable automatic backups in the app manifest and add explicit backup and data extraction rules that exclude shared preferences from backup operations.

Changes

Cohort / File(s)	Summary
Manifest Configuration app/src/main/AndroidManifest.xml	Disabled auto-backup (allowBackup changed to false) and added references to backup and data extraction rule files.
Backup Configuration Resources app/src/main/res/xml/backup_rules.xml, app/src/main/res/xml/data_extraction_rules.xml	Added new XML resource files that exclude shared preferences from full backups and automated data extraction operations.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title 'Security: disable backup to protect stored credentials' accurately and specifically describes the main change: disabling Android backup to prevent exposure of sensitive credentials stored in SharedPreferences.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[capcom6]

Hello!

Thank you for your PR.

However, what is the real-world situation?

Exploiting this vulnerability requires physical access to an unlocked device, at a minimum, to enable ADB. However, it's much easier to open the app and access the credentials directly. The only field that can't be accessed through the UI is the device authentication token, and yes, it can be used to clone the app.

On the other hand, there's currently no way to recover an account if the username or password is lost. A backup might be useful in this case.

So, I need additional feedback on this scenario.

[github-actions]

This PR is stale because it has been open for 7 days with no activity.