This project has been audited and hardened following the OWASP Mobile Application Security Verification Standard (MASVS). The security improvements apply to data storage, network transport, platform interactions, and code quality.
MASVS-STORAGE
| Measure | Implementation |
|---|---|
| Scoped Storage | Application data resides in app-private directories via Context.getExternalFilesDir(). This prevents other applications from accessing xtui configuration and logs. |
| Backup Protection | android:allowBackup="false" prevents sensitive data extraction via ADB backups. |
| Secure File Sharing | Uses FileProvider with content URIs instead of vulnerable file:// URIs for inter-app file sharing. |
MASVS-NETWORK
| Measure | Implementation |
|---|---|
| Enforced TLS | android:usesCleartextTraffic="false" disables plaintext HTTP globally. All connections use TLS 1.2+. |
| Secure Endpoints | All internal service endpoints (connectivity checks) use HTTPS. |
MASVS-PLATFORM
| Measure | Implementation |
|---|---|
| Signature-Level Permissions | Custom permission x.xtui.launcher.permission.RECEIVE_CMD with protectionLevel="signature" ensures only apps signed with the same key can send commands to the launcher. |
| Immutable Intents | All system-bound PendingIntents use FLAG_IMMUTABLE to prevent intent redirection attacks (Android 12+ requirement). |
| Receiver Security | All Broadcast Receivers use explicit export flags (RECEIVER_EXPORTED or RECEIVER_NOT_EXPORTED) to prevent unauthorized external triggers. |
MASVS-CODE / MASVS-RESILIENCE
| Measure | Implementation |
|---|---|
| Minification | Release builds use R8/ProGuard (minifyEnabled true) for code shrinking and obfuscation. |
| Resource Shrinking | shrinkResources true removes unused resources from release builds. |
| Foreground Services | Foreground service types (specialUse, mediaPlayback) comply with Android 14 requirements. |
If you discover a security vulnerability, please report it by opening an issue on the GitHub repository. Do not include exploit details in public issues. Use a private disclosure if the repository supports it.