🔒 Disable Auto Backup to prevent data leakage - #36

⚠️ Potential issue | 🟠 Major

Add explicit data extraction rules to fully disable backups on Android 12+.

Setting android:allowBackup="false" alone does not prevent device-to-device transfers on some Android 12+ devices. Add android:dataExtractionRules="@xml/data_extraction_rules" with explicit excludes for all data domains, and android:fullBackupContent="@xml/backup_rules" for Android 11 compatibility.

 <application
     android:label="RepForge"
     android:name="${applicationName}"
     android:icon="@mipmap/ic_launcher"
-    android:allowBackup="false">
+    android:allowBackup="false"
+    android:fullBackupContent="@xml/backup_rules"
+    android:dataExtractionRules="@xml/data_extraction_rules">

<?xml version="1.0" encoding="utf-8"?>
<data-extraction-rules>
    <cloud-backup>
        <exclude domain="root" path="." />
        <exclude domain="file" path="." />
        <exclude domain="database" path="." />
        <exclude domain="sharedpref" path="." />
        <exclude domain="external" path="." />
    </cloud-backup>
    <device-transfer>
        <exclude domain="root" path="." />
        <exclude domain="file" path="." />
        <exclude domain="database" path="." />
        <exclude domain="sharedpref" path="." />
        <exclude domain="external" path="." />
    </device-transfer>
</data-extraction-rules>

<?xml version="1.0" encoding="utf-8"?>
<full-backup-content>
    <exclude domain="root" path="." />
    <exclude domain="file" path="." />
    <exclude domain="database" path="." />
    <exclude domain="sharedpref" path="." />
    <exclude domain="external" path="." />
</full-backup-content>

Verify each finding against the current code and only fix it if needed.

In `@workout-logger/android/app/src/main/AndroidManifest.xml` around lines 5 - 6,
The manifest currently only sets android:allowBackup="false" which is
insufficient on Android 12+; update the <application> attributes to add
android:dataExtractionRules="@xml/data_extraction_rules" and
android:fullBackupContent="@xml/backup_rules", and add the two XML resources
(res/xml/data_extraction_rules.xml and res/xml/backup_rules.xml) containing
explicit exclude entries for root, file, database, sharedpref, and external
domains for both cloud-backup and device-transfer (data_extraction_rules) and
full-backup-content (backup_rules) so all data domains are excluded.

@coderabbitai is there any specific reason why we are disabling backups?

@Devasy, great question! Here are the key reasons why disabling android:allowBackup is a security best practice:

1. Sensitive data exposure: Android's Auto Backup (enabled by default) automatically uploads app data — including databases, shared preferences, and files — to the user's Google Drive. If that Google account is compromised, an attacker could restore the backup onto another device and access all of your app's stored data (e.g., workout history, user credentials, session tokens).

2. Unintended data retention: Even after a user uninstalls the app, backed-up data can persist in the cloud and be restored when the app is reinstalled, potentially on a different device. This creates unintended data retention that may conflict with privacy expectations.

3. ADB backup attack vector: On older Android versions, allowBackup="true" also enables backup via ADB (adb backup), meaning anyone with physical USB access to an unlocked device could extract app data — a significant risk for apps handling personal health/fitness data.

4. Google Play compliance: Google's Privacy and Security guidelines recommend explicitly controlling backup behavior for apps that handle personal or sensitive data.

For a workout logger storing personal health/fitness data, disabling backups is the right call. However, as my review comment noted, android:allowBackup="false" alone is not sufficient on Android 12+ — you also need android:dataExtractionRules to block device-to-device transfers, and android:fullBackupContent for Android 11 and below compatibility. The fix suggested in the review comment addresses all of these cases comprehensively.

I can clarify this since I authored the change: We are disabling backups as a security measure to prevent potential data leakage. By default, Android automatically backs up application data to Google Drive, which could expose sensitive application data or user information if the user's backup account is compromised. Setting android:allowBackup="false" ensures that the app's data stays securely on the device.

Skipped: comment is from another GitHub bot.