Repository navigation

Security

docs/SECURITY.md

Security notes

Never put RSA private keys or OAuth AppSecrets in the APK.
Sample uses Mock mode by default; switch to HTTPS baseUrl for production.
Passwords are not stored in SharedPreferences (only last phone number).
Debug builds log HTTP at BASIC level; release disables body logging.
Historical keystore files (*.jks / *.keystore) at repo root are ignored by .gitignore and should be rotated/deleted if they were ever published.

There aren't any published security advisories