diff options
| author | Peter Stone <thepeterstone@gmail.com> | 2026-08-22 01:07:10 +0000 |
|---|---|---|
| committer | Peter Stone <thepeterstone@gmail.com> | 2026-08-22 01:07:10 +0000 |
| commit | 78bc7b3c48eae1b68d3f35c81ea2b959d8136477 (patch) | |
| tree | 0f516424bfea2b8af815a5c218837f5b1804d8c0 /app/build.gradle.kts | |
| parent | 429594e6bc1069f7e7141060df3a0fd8bf63749b (diff) | |
Encrypt the Stash API key at rest
The key is a bearer credential for the user's own Stash server, sent
as X-API-Key on every request -- previously stored in plain DataStore
preferences, recoverable in cleartext from a rooted device, an
unlocked-bootloader device, or a local backup/extraction tool. Now
stored via EncryptedSharedPreferences (Android Keystore-backed
AES-256). An existing key is migrated from the old plaintext location
once, on first read, then the plaintext copy is cleared.
Diffstat (limited to 'app/build.gradle.kts')
| -rw-r--r-- | app/build.gradle.kts | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/app/build.gradle.kts b/app/build.gradle.kts index 63ed33a..32313ab 100644 --- a/app/build.gradle.kts +++ b/app/build.gradle.kts @@ -58,6 +58,7 @@ dependencies { implementation("androidx.work:work-runtime-ktx:2.9.0") implementation("androidx.datastore:datastore-preferences:1.1.1") + implementation("androidx.security:security-crypto:1.1.0-alpha06") implementation("com.squareup.okhttp3:okhttp:4.12.0") implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3") |