---
name: hoangnguyen0403/android-legacy-security
source: https://app.decimal.ai/s/hoangnguyen0403-android-legacy-security@1/SKILL.md
source_sha256: ee1589c1d3f6
---

# Android Legacy Security Standards

## **Priority: P0 (CRITICAL)**

## 1. Secure Intents and Components

- Set `android:exported="false"` for all internal Activities/Services unless needed for deep links.
- Verify `resolveActivity` before starting implicit intents.
- Treat all incoming Intent extras as untrusted — validate all schema/data types.

See [hardening examples](references/implementation.md) for manifest and component restrictions.

## 2. Lock Down WebViews

- Default to `javaScriptEnabled = false`. Use `WebViewClient` and `WebChromeClient` to restrict navigation.
- Disable `allowFileAccess` and `allowFileAccessFromFileURLs` to prevent local file theft via XSS.
- If using `@JavascriptInterface` (API 17+), strictly limit exposed API surface.

See [hardening examples](references/implementation.md) for WebView lockdown patterns.

## 3. Protect Storage and Files

- **NEVER expose `file://` URIs**. Use `FileProvider` to generate `content://` URIs with temporary permissions.
- Use `EncryptedSharedPreferences` for auth tokens and PII. Never use legacy public-read file modes.
- Use `NetworkSecurityConfig` to disable `cleartextTrafficPermitted` and implement certificate pinning.

## Anti-Patterns

- **No Implicit Intents Internally**: Use explicit intents with component class name.
- **No Public Read Modes**: Never expose SharedPreferences or files with global read access.

## References

- [Hardening Examples](references/implementation.md)