From 78bc7b3c48eae1b68d3f35c81ea2b959d8136477 Mon Sep 17 00:00:00 2001 From: Peter Stone Date: Sat, 22 Aug 2026 01:07:10 +0000 Subject: Encrypt the Stash API key at rest The key is a bearer credential for the user's own Stash server, sent as X-API-Key on every request -- previously stored in plain DataStore preferences, recoverable in cleartext from a rooted device, an unlocked-bootloader device, or a local backup/extraction tool. Now stored via EncryptedSharedPreferences (Android Keystore-backed AES-256). An existing key is migrated from the old plaintext location once, on first read, then the plaintext copy is cleared. --- app/build.gradle.kts | 1 + 1 file changed, 1 insertion(+) (limited to 'app/build.gradle.kts') diff --git a/app/build.gradle.kts b/app/build.gradle.kts index 63ed33a..32313ab 100644 --- a/app/build.gradle.kts +++ b/app/build.gradle.kts @@ -58,6 +58,7 @@ dependencies { implementation("androidx.work:work-runtime-ktx:2.9.0") implementation("androidx.datastore:datastore-preferences:1.1.1") + implementation("androidx.security:security-crypto:1.1.0-alpha06") implementation("com.squareup.okhttp3:okhttp:4.12.0") implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3") -- cgit v1.2.3