SHA256
Yuvomi Mobile Contributors
2d12491516
Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.
48 lines
3.1 KiB
Markdown
48 lines
3.1 KiB
Markdown
# Security review record
|
|
|
|
This is an engineering review, not an independent penetration test or certification.
|
|
|
|
Addressed during implementation:
|
|
|
|
- Canonical, HTTPS-only origin/port comparison; credential, fragment, query,
|
|
subpath, scheme, lookalike-host and TLS-downgrade regression cases.
|
|
- A main-frame POST can bypass Android's usual navigation callback. The request
|
|
interception gate now rejects **all** cross-origin requests, not only subresources.
|
|
The emulator regression was observed failing when the main-frame guard was
|
|
deliberately removed, then rerun with the fix restored.
|
|
- TLS failures cancel by default. Native download redirects are refused before
|
|
cookies can be replayed to another origin. Bootstrap requests use neither
|
|
cookies nor automatic redirects and have bounded metadata reads/timeouts.
|
|
- Files use explicit system selection/content URIs; no filesystem or storage
|
|
permission is granted to web content. Blob exports have no native JS bridge.
|
|
- Complete Android browsing-data deletion uses WebStorageCompat, with OS app
|
|
reset for engines without that capability. WebStorage.deleteAllData alone was
|
|
insufficient for service-worker CacheStorage/IndexedDB and is not relied upon.
|
|
- iOS server erase replaces the WKWebView, not only its URL, eliminating old
|
|
history/back-forward contexts as well as persistent website data.
|
|
- iOS metadata uses typed decoding, rejecting numeric values masquerading as booleans.
|
|
- Native picker results are bound to the browsing generation/request. Android
|
|
rejects stale upload/download selections, revokes camera URI grants, and clears
|
|
capture cache on erasure. iOS ignores export-cancellation callbacks from an old
|
|
download. Apple-specific callback regressions have not run without Xcode.
|
|
- KGP was upgraded after OSV identified CVE-2026-53914 in the original build tool.
|
|
The final OSV scan found no listed advisories across 213 locked/direct Maven
|
|
coordinates and build plugins. Rescan after resolution/lock updates.
|
|
- The inspected release APK is not debuggable, rejects cleartext, disables backup
|
|
and trusts system CAs only. AndroidX's exported profile installer receiver is
|
|
protected by the system DUMP permission; app providers are not exported.
|
|
|
|
Release gates still requiring evidence:
|
|
|
|
- Actual Xcode typecheck, simulator, archive, physical-device and accessibility review.
|
|
- End-to-end IdP flows, especially providers that prohibit embedded agents; no
|
|
browser-to-native session transfer is supported by the current upstream protocol.
|
|
- iOS unknown-length download disk-pressure behavior; a post-download size check
|
|
is not a streaming quota. Verify file picker/camera cancellation on real devices.
|
|
- Android file-picker/camera/rotation while a picker is outstanding; cancellation
|
|
on process death intentionally loses the selection, never silently retries it.
|
|
- Offline sign-out/account switching, stale-worker updates and server erasure on
|
|
current WebView/WKWebView versions. Upstream tests are not native device proof.
|
|
- Reverify final signed release manifests, signing, store ownership, private vulnerability contact
|
|
and applicable privacy disclosures. No claim that all vulnerabilities are absent.
|