Skip to content

🔒 Disable Auto Backup to prevent data leakage #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Devasy wants to merge 3 commits into
base: main
Choose a base branch
from
Open

🔒 Disable Auto Backup to prevent data leakage #36

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f4e1821
🔒 Disable Auto Backup to prevent data leakage
google-labs-jules[bot] Apr 24, 2026
4b2f6ef
🔒 Disable Auto Backup to prevent data leakage
google-labs-jules[bot] Apr 24, 2026
2c3ad57
🔒 Disable Auto Backup to prevent data leakage
google-labs-jules[bot] Apr 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion workout-logger/android/app/src/main/AndroidManifest.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
<application
android:label="RepForge"
android:name="${applicationName}"
android:icon="@mipmap/ic_launcher">
android:icon="@mipmap/ic_launcher"
android:allowBackup="false">
Comment on lines +5 to +6

@coderabbitai coderabbitai Bot Apr 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

According to the latest Android documentation, does android:allowBackup="false"fully disable both cloud backup and device-to-device transfer on Android 12+? If not, what exact combination ofallowBackup, fullBackupContent, and dataExtractionRules is recommended to guarantee no app data backup/transfer?

💡 Result:

No, according to the latest Android documentation, setting android:allowBackup="false" does not fully disable both cloud backup and device-to-device (D2D) transfer on Android 12+. On devices from some manufacturers, android:allowBackup="false" disables cloud backups (e.g., Google Drive) but does not disable D2D transfers. To guarantee no app data backup or transfer on Android 12+, use the following combination in the AndroidManifest.xml element: android:allowBackup="false" android:dataExtractionRules="@xml/data_extraction_rules" Create res/xml/data_extraction_rules.xml with excludes for all domains in both and : For compatibility with Android 11 and lower, also add android:fullBackupContent="@xml/backup_rules" with similar excludes in a backup_rules.xml file using syntax. This configuration explicitly excludes all app data from both cloud backups and D2D transfers while disabling legacy backups.

Citations:

Add explicit data extraction rules to fully disable backups on Android 12+.

Setting android:allowBackup="false" alone does not prevent device-to-device transfers on some Android 12+ devices. Add android:dataExtractionRules="@xml/data_extraction_rules" with explicit excludes for all data domains, and android:fullBackupContent="@xml/backup_rules" for Android 11 compatibility.

Manifest and configuration files required

Update AndroidManifest.xml:

 <application
     android:label="RepForge"
     android:name="${applicationName}"
     android:icon="@mipmap/ic_launcher"
-    android:allowBackup="false">
+    android:allowBackup="false"
+    android:fullBackupContent="@xml/backup_rules"
+    android:dataExtractionRules="@xml/data_extraction_rules">

Create res/xml/data_extraction_rules.xml:

<?xml version="1.0" encoding="utf-8"?>
<data-extraction-rules>
    <cloud-backup>
        <exclude domain="root" path="." />
        <exclude domain="file" path="." />
        <exclude domain="database" path="." />
        <exclude domain="sharedpref" path="." />
        <exclude domain="external" path="." />
    </cloud-backup>
    <device-transfer>
        <exclude domain="root" path="." />
        <exclude domain="file" path="." />
        <exclude domain="database" path="." />
        <exclude domain="sharedpref" path="." />
        <exclude domain="external" path="." />
    </device-transfer>
</data-extraction-rules>

Create res/xml/backup_rules.xml:

<?xml version="1.0" encoding="utf-8"?>
<full-backup-content>
    <exclude domain="root" path="." />
    <exclude domain="file" path="." />
    <exclude domain="database" path="." />
    <exclude domain="sharedpref" path="." />
    <exclude domain="external" path="." />
</full-backup-content>
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@workout-logger/android/app/src/main/AndroidManifest.xml` around lines 5 - 6,
The manifest currently only sets android:allowBackup="false" which is
insufficient on Android 12+; update the <application> attributes to add
android:dataExtractionRules="@xml/data_extraction_rules" and
android:fullBackupContent="@xml/backup_rules", and add the two XML resources
(res/xml/data_extraction_rules.xml and res/xml/backup_rules.xml) containing
explicit exclude entries for root, file, database, sharedpref, and external
domains for both cloud-backup and device-transfer (data_extraction_rules) and
full-backup-content (backup_rules) so all data domains are excluded.

@Devasy Devasy Apr 24, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai is there any specific reason why we are disabling backups?

@coderabbitai coderabbitai Bot Apr 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Devasy, great question! Here are the key reasons why disabling android:allowBackup is a security best practice:

  1. Sensitive data exposure: Android's Auto Backup (enabled by default) automatically uploads app data — including databases, shared preferences, and files — to the user's Google Drive. If that Google account is compromised, an attacker could restore the backup onto another device and access all of your app's stored data (e.g., workout history, user credentials, session tokens).

  2. Unintended data retention: Even after a user uninstalls the app, backed-up data can persist in the cloud and be restored when the app is reinstalled, potentially on a different device. This creates unintended data retention that may conflict with privacy expectations.

  3. ADB backup attack vector: On older Android versions, allowBackup="true" also enables backup via ADB (adb backup), meaning anyone with physical USB access to an unlocked device could extract app data — a significant risk for apps handling personal health/fitness data.

  4. Google Play compliance: Google's Privacy and Security guidelines recommend explicitly controlling backup behavior for apps that handle personal or sensitive data.

For a workout logger storing personal health/fitness data, disabling backups is the right call. However, as my review comment noted, android:allowBackup="false" alone is not sufficient on Android 12+ — you also need android:dataExtractionRules to block device-to-device transfers, and android:fullBackupContent for Android 11 and below compatibility. The fix suggested in the review comment addresses all of these cases comprehensively.

@google-labs-jules google-labs-jules Bot Apr 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can clarify this since I authored the change: We are disabling backups as a security measure to prevent potential data leakage. By default, Android automatically backs up application data to Google Drive, which could expose sensitive application data or user information if the user's backup account is compromised. Setting android:allowBackup="false" ensures that the app's data stays securely on the device.

@coderabbitai coderabbitai Bot Apr 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: comment is from another GitHub bot.

<activity
android:name=".MainActivity"
android:exported="true"
Expand Down