From 95ea9ffed5123e29b3104c3a75779856ca8294e7 Mon Sep 17 00:00:00 2001
From: null <koga.industries@gmail.com>
Date: Tue, 16 Jun 2026 21:58:17 -0500
Subject: [PATCH] security: disable auto backup, rewrite backup rules as
 allowlist, harden data extraction rules for Android 12+

---
 app/src/main/AndroidManifest.xml              |  2 +-
 app/src/main/res/xml/backup_rules.xml         | 19 +++++++++++++-
 .../main/res/xml/data_extraction_rules.xml    | 25 +++++++++++++++++--
 3 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 4637c3f0..c6b4c36e 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -6,7 +6,7 @@
 
     <application
         android:name=".CloserApp"
-        android:allowBackup="true"
+        android:allowBackup="false"
         android:dataExtractionRules="@xml/data_extraction_rules"
         android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
diff --git a/app/src/main/res/xml/backup_rules.xml b/app/src/main/res/xml/backup_rules.xml
index 2b73765c..7a32c2f0 100644
--- a/app/src/main/res/xml/backup_rules.xml
+++ b/app/src/main/res/xml/backup_rules.xml
@@ -1,5 +1,22 @@
 <?xml version="1.0" encoding="utf-8"?>
+<!-- 
+    BACKUP RULES - ALLOWLIST APPROACH
+    
+    The relationship app uses allowlist (whitelist) backup rules for security.
+    Only explicitly listed items may be backed up. Any new storage (databases,
+    shared preferences, DataStore files, etc.) must be manually evaluated and
+    added to this allowlist if backup is safe and desired.
+    
+    By default, no app data is backed up. Sensitive items like databases,
+    shared preferences, and DataStore files are excluded.
+    
+    To add an item: add a <include> element with appropriate domain/path.
+    To exclude an item: add an <exclude> element with appropriate domain/path.
+-->
 <full-backup-content>
-    <exclude domain="sharedpref" path="local_answers" />
+    <!-- No items included by default - sensitive data only -->
+    <!-- Explicit exclusions for clarity (all default storage types) -->
     <exclude domain="database" path="." />
+    <exclude domain="sharedpref" path="." />
+    <exclude domain="file" path="." />
 </full-backup-content>
diff --git a/app/src/main/res/xml/data_extraction_rules.xml b/app/src/main/res/xml/data_extraction_rules.xml
index e0e5ebfe..93439af0 100644
--- a/app/src/main/res/xml/data_extraction_rules.xml
+++ b/app/src/main/res/xml/data_extraction_rules.xml
@@ -1,11 +1,32 @@
 <?xml version="1.0" encoding="utf-8"?>
+<!-- 
+    DATA EXTRACTION RULES - ALLOWLIST APPROACH
+    
+    Android 12+ backup/extraction rules for cloud backup and device transfer.
+    Uses allowlist (whitelist) approach for security - only explicitly listed
+    items may be backed up. Any new storage must be manually evaluated and
+    added to this allowlist if backup is safe and desired.
+    
+    By default, no app data is backed up. Sensitive items like databases,
+    shared preferences, and DataStore files are excluded.
+    
+    To add an item: add a <include> element with appropriate domain/path.
+    To exclude an item: add an <exclude> element with appropriate domain/path.
+-->
 <data-extraction-rules>
     <cloud-backup>
-        <exclude domain="sharedpref" path="local_answers" />
+        <!-- No items included by default - sensitive data only -->
+        <!-- Explicit exclusions for all default storage types -->
         <exclude domain="database" path="." />
+        <exclude domain="sharedpref" path="." />
+        <exclude domain="file" path="." />
     </cloud-backup>
+    
     <device-transfer>
-        <exclude domain="sharedpref" path="local_answers" />
+        <!-- No items included by default - sensitive data only -->
+        <!-- Explicit exclusions for all default storage types -->
         <exclude domain="database" path="." />
+        <exclude domain="sharedpref" path="." />
+        <exclude domain="file" path="." />
     </device-transfer>
 </data-extraction-rules>