All guides · Page 7
Browse by topic, or search for a specific concept, tool or platform.
Trust boundaries in Android Intent redirection
Launching an Intent received from another application can process external input with your application's privileges.
Read the guideContentProvider access and data exposure
ContentProvider can expose application data to other processes. Excessive access can disclose personal information despite strong code protection.
Read the guideNarrowly scoped file sharing with FileProvider
Sharing should expose the document a recipient needs, not the application's entire filesystem. FileProvider helps manage that boundary.
Read the guideBroadcastReceiver and incoming-message validation
Receiving a broadcast does not make its content trustworthy. Receivers that initiate sensitive work need source and authorization checks.
Read the guideBound Service security and caller authorization
Bound services expose functions across applications. Exporting a service creates a need for access checks on its methods too.
Read the guideSignature-based trust with Android custom permissions
Custom permissions restrict component access under defined conditions. Naming a permission does not establish the correct protection level.
Read the guideLimiting sensitive data in the Android clipboard
Copied content leaves the application's screen boundary. The clipboard is unsuitable storage for session tokens, secret keys or persistent credentials.
Read the guideMinimizing data in Android notifications
Notifications may appear on lock screens, connected devices or history. Protecting the application screen does not protect every copy.
Read the guideHow scoped storage affects application data
Storage location determines which applications and user actions can reach data. Scoped storage is part of that access model.
Read the guideDocument permissions with the Storage Access Framework
Selecting a document grants access to a resource, not unrestricted trust in its contents. Treat the returned URI as external input.
Read the guideProtection boundaries in Room databases
Room organizes data access; it does not automatically encrypt the database. Assess why each sensitive field must be stored.
Read the guideIs DataStore a secure secrets vault?
DataStore manages small application datasets. Convenient preference storage does not automatically make it suitable for tokens or cryptographic keys.
Read the guideChecking Logcat for sensitive information
Logs aid development but create another exposure surface when they contain headers or personal data. Define production logging policy explicitly.
Read the guideChecking debuggable in release packages
Development settings can broaden inspection and tampering access if shipped. Check the final manifest, not only the source file.
Read the guideReducing Android cleartext traffic exceptions
Unencrypted connections expose data to observation or modification. One legacy endpoint can affect a sensitive flow.
Read the guideWebView file access and local content
Combining local files and remote content in a WebView can blur trust boundaries. Restrict file settings to actual needs.
Read the guideOrigin validation for WebView messages
Web content that can call native functions has substantial power. Missing origin validation can expose that power to unintended content.
Read the guidePackage visibility and Android security SDKs
Android limits what applications can query about other installed packages. These rules affect security SDK detection coverage.
Read the guideSafe, usable behavior after permission denial
Permission refusal requires both a security decision and a usable product flow. Refusal alone is not an attack signal.
Read the guideBinding BiometricPrompt to a cryptographic operation
A successful biometric dialog and biometric authorization of key use provide different security properties. That distinction matters for sensitive actions.
Read the guideData boundaries between work and personal profiles
Work profiles help separate enterprise applications and data from personal use. Sharing flows must preserve that boundary.
Read the guideSecurity in Android tasks and activity flows
Task stacks and activity launches affect which screen users see and in what context. Review more than the contents of individual screens.
Read the guideSafe paths when extracting archives
ZIP entry names are not trusted filesystem paths. Extraction must remain within the application's permitted destination.
Read the guideTrust boundaries in Android data parsing
Turning files, Intents or network data into application objects creates an attack surface. Constrain input before it reaches the parser.
Read the guideMemory safety in Android native code
JNI and native libraries can improve performance while introducing memory-management risks. Managed-code checks do not automatically cover them.
Read the guideChoosing Keychain accessibility classes
When a Keychain item can be read is part of iOS app protection. Background work on a locked device may need different conditions from an interactive secret.
Read the guideLimiting Keychain access-group sharing
Keychain groups allow applications to share secrets and therefore a trust boundary.
Read the guideCleaning up Keychain items on logout
Logout involves more than changing the screen. Coordinate local records, server sessions and background work.
Read the guideiOS keys after biometric enrollment changes
Enrollment changes can affect sensitive-key access. Handle them as a defined lifecycle event rather than a generic error.
Read the guideLimits on Secure Enclave key use
Secure Enclave provides a strong boundary for supported key operations. It does not automatically contain every application secret or key type.
Read the guideiOS file protection classes and device lock state
File protection defines how data access relates to device locking. Derive the required access window from the product flow.
Read the guideSensitive screens in the iOS app switcher
Backgrounding can leave private information in app-switcher previews. Assess screens containing balances or personal documents.
Read the guideRealistic expectations for iOS capture detection
Recording and mirroring can carry data outside the application. Detectable conditions and preventable conditions are not identical.
Read the guideiOS pasteboard and sharing decisions
Pasteboard convenience moves data beyond the application's boundary. Automatically copying persistent secrets is a poor default.
Read the guideSecrets and content in notification extensions
A notification extension runs outside the main application's execution context. Review its data, keys and endpoints separately.
Read the guideLimiting data in iOS widgets
Widgets display information without opening the application. This creates a wider display surface and a separate refresh lifecycle.
Read the guideSafely handling Share Extension input
Shared content comes from another application. Treat filenames, type metadata and lengths as untrusted.
Read the guideSessions and data in iOS background transfers
Transfers may continue while the app is not visible. Logout and access changes must be reflected in ongoing work.
Read the guideSensitive responses in URLCache
Caching can improve performance while retaining sensitive responses longer than expected. Set policy by data class.
Read the guideWKWebView cookies and web-data cleanup
A WebView session can outlive the main application's session. Persistent web login after native logout can mix account data.
Read the guideValidating custom URL schemes on iOS
Custom schemes create application entry points. Validate parameters and authority for the requested operation separately.
Read the guideAssociated Domains and application relationships
Associated Domains establishes specific platform relationships between apps and domains. Excessive scope can route unexpected links into the application.
Read the guideLAContext lifetime and reauthentication
The lifetime of local authentication is a security and usability choice. An old success result should not grant unlimited authority.
Read the guideSensitive-data scope in iCloud synchronization
Synchronization moves local information to other devices and cloud services. Revisit assumptions that data stays on one phone.
Read the guideChoosing files to exclude from iOS backups
Backups help users recover, but unnecessary sensitive or reproducible files create extra copies.
Read the guidePersonal data in iOS crash reports
Diagnostics need context, but usually not user messages or access tokens. Choose the reporting schema deliberately.
Read the guideSecurity and data boundaries in App Clips
A short, fast App Clip task still needs authorization and input validation. Define its relationship with the full application.
Read the guideProduction data in TestFlight builds
TestFlight enables real-device testing, not unrestricted production-data access. Separate accounts and environments.
Read the guideSession consistency across multiple iOS scenes
An application can have multiple windows or scenes. Logging out in one must not leave sensitive content visible in another.
Read the guideData surfaces in sensitive iOS text input
For passwords and secrets, consider keyboards, autofill and diagnostics as well as visible text. Fields should reflect data sensitivity.
Read the guide