ProtonVPN · terrypearson · Jul 29, 2025 · Jul 24, 2025 · Jul 29, 2025 · Aug 1, 2025
diff --git a/.gitattributes b/.gitattributes
@@ -1,2 +1,4 @@
 *.psd filter=lfs diff=lfs merge=lfs -text
+*.aar filter=lft diff=lfs merge=lfs -text
 detekt.yml text eol=lf
+app/src/*/screenshotTest/** filter=lfs diff=lfs merge=lfs -text
diff --git a/.gitignore b/.gitignore
@@ -4,11 +4,13 @@
 /.idea
 .DS_Store
 /build
-/config
-strongswan-android-complete/build/**
+/config/detekt/config.yml
+/config/detekt/reports
+/observability/domain/build
 openvpn/build/**
 /captures
 .externalNativeBuild
 openvpn/src/main/cpp/asio/asio/src/doc/
 openvpn/.cxx/
 pmcrypto/build/
+app/src/androidTest/assets/sensitive/
diff --git a/.gitleaks.toml b/.gitleaks.toml
@@ -0,0 +1,29 @@
+[extend]
+path = "/etc/gitleaks/proton.toml"
+
+[allowlist]
+paths = [
+    # OpenVPN test data
+    '''^openvpn/src/main/cpp/asio/asio/src/examples/(.*)''',
+    '''^openvpn/src/main/cpp/openvpn/doc/(.*)''',
+    '''^openvpn/src/main/cpp/openvpn/sample/(.*)''',
+    '''^openvpn/src/main/cpp/openvpn/tests/(.*)''',
+    '''^openvpn/src/test/(.*)''',
+    '''^openvpn/src/main/cpp/openvpn3/doc/(.*)''',
+    '''^openvpn/src/main/cpp/openvpn3/test/(.*)''',
+    # OpenSSL and mbedtls - never modified by us.
+    '''^openvpn/src/main/cpp/openssl/(.*)$''',
+    '''^openvpn/src/main/cpp/mbedtls/(.*)''',
+    # A patch file with false positive - never modified by us.
+    '''^openvpn/src/main/cpp/openvpn/contrib/vcpkg-ports/pkcs11-helper/pkcs11-helper-001-RFC7512.patch''',
+    # R8 mapping file, contains function names, line numbers and other symbols that can be picked as false positives.
+    '''^app/build/outputs/mapping/(.*)/mapping.txt$''',
+    '''^app/build/outputs/mapping/(.*)/seeds.txt$''',
+    '''^app/build/outputs/mapping/(.*)/usage.txt$''',
+    # Semgrep configuration file
+    '''^custom/semgrep/rules.yaml$''',
+    # Added by CI job
+    '''^appetize-information.json$''',
+    # Profile rules are interpreted as secrets
+    '''^app/src/productionGooglePlayStoreRelease/generated/baselineProfiles/(.*)''',
+]
diff --git a/.gitleaksignore b/.gitleaksignore
@@ -0,0 +1,7 @@
+# Code searching for "BEGIN RSA..."
+openvpn/src/main/cpp/openvpn3/openvpn/client/cliopthelper.hpp:private-key:211
+# Sample HTTP auth header in comment
+openvpn/src/main/cpp/openvpn3/openvpn/ws/httpcreds.hpp:authorization-header:42
+# HTTP authorization code
+openvpn/src/main/cpp/openvpn3/openvpn/transport/client/httpcli.hpp:authorization-header:697
+openvpn/src/main/cpp/openvpn3/openvpn/ws/httpcli.hpp:authorization-header:1154
diff --git a/.gitmodules b/.gitmodules
diff --git a/.grype.yaml b/.grype.yaml
@@ -0,0 +1 @@
+# This file was created to make grype job always pass.
diff --git a/.idea/icon.svg b/.idea/icon.svg
diff --git a/.semgrep.yml b/.semgrep.yml
@@ -0,0 +1,9 @@
+exclude:
+# we already run gitleaks separately, no need for duplicate reports
+- generic.secrets.gitleaks.
+# semgrepignore changes are being reviewed in MRs
+- generic.ci.audit.changed-semgrepignore.changed-semgrepignore
+# low quality rules with high number of false positives
+- MSTG-
+# low quality rules that trigger on words like 'key' or 'Log'
+- mobsf.mobsfscan.android.
diff --git a/.semgrepignore b/.semgrepignore
@@ -0,0 +1,7 @@
+/.gradle/
+/.sec/
+/openvpn/
+
+# oss_licenses is embedded in the app, it has JS for generating 3rd party licenses HTML
+# from a JSON data file. No external input.
+/app/src/main/assets/oss_licenses
diff --git a/CODEOWNERS b/CODEOWNERS
@@ -0,0 +1,2 @@
+# ownership: tight
+*	@ProtonVPN/groups/android-developers 
diff --git a/Dockerfile b/Dockerfile
diff --git a/README.md b/README.md
@@ -1,22 +1,36 @@
 # ProtonVPN for Android
 
-Copyright (c) 2019 Proton Technologies AG
+Copyright (c) 2019 Proton AG
+
+## Download
+
+<p align="center">
+    <img src="https://raw.githubusercontent.com/ProtonVPN/android-app/master/metadata/en-US/images/phoneScreenshots/2.jpg" height="400">
+    <img src="https://raw.githubusercontent.com/ProtonVPN/android-app/master/metadata/en-US/images/phoneScreenshots/3.jpg" height="400">
+    <img src="https://raw.githubusercontent.com/ProtonVPN/android-app/master/metadata/en-US/images/phoneScreenshots/4.jpg" height="400">
+    <img src="https://raw.githubusercontent.com/ProtonVPN/android-app/master/metadata/en-US/images/phoneScreenshots/5.jpg" height="400">
+</p>
+
+<p align="center">
+    <a href="https://play.google.com/store/apps/details?id=ch.protonvpn.android">
+        <img src="https://play.google.com/intl/en_us/badges/images/generic/en_badge_web_generic.png" alt="Get it on Google Play" height="80">
+    </a>
+    <a href="https://f-droid.org/packages/ch.protonvpn.android">
+        <img src="https://f-droid.org/badge/get-it-on.png" alt="Get it on F-Droid" height="80">
+    </a>
+    <a href="https://github.com/ProtonVPN/android-app/releases">
+        <img src="https://i.postimg.cc/kXfbyWjL/get-it-on-github.png" alt="Get it on GitHub" height="80">
+    </a>
+</p>
 
 ## Build instructions
 - Install sdk, ndk, cmake, swig
 - Clone this repository
-- `./gradlew assembleProdDebug` or open and build in Android Studio
+- `./gradlew assembleProductionVanillaOpenSourceDebug` or open and build in Android Studio
 
 ### Build release
 To complete a release build signing keys need to be provided:
-./gradlew assembleProdRelease -PkeyStoreFilePath=<keystore> -PkeyStoreKeyAlias=<alias> -PkeyStorePassword=<pass> -PkeyStoreKeyPassword=<key-pass>`
-
-### Rebuild strongswan
-This project is using native libraries from [open-source project Strongswan](https://www.strongswan.org/).
-To simplify the build process we include prebuilt copies of those libraries [here](app/src/main/jniLibs). To rebuild them follow these steps:
-- `git submodule init` followed by `git submodule update` in the main directory (we include original Strongswan repository as a git submodule)
-- `cd strongswan` and follow [build instructions](https://wiki.strongswan.org/projects/strongswan/wiki/AndroidVPNClientBuild) from Strongswan to rebuild native libraries
-- after a successful build, run `cp -r strongswan/src/frontends/android/app/src/main/libs/* app/src/main/jniLibs` in our main directory to copy the prebuilt libraries and rebuild the ProtonVPN client
+- `./gradlew assembleProductionVanillaOpenSourceRelease -PkeyStoreFilePath=<keystore> -PkeyStoreKeyAlias=<alias> -PkeyStorePassword=<pass> -PkeyStoreKeyPassword=<key-pass>`
 
 ## Code style
 Project uses agreed code style ProtonStyle.xml for java. Import it in Android studio via ```File>>Settings>>Editor>>Code style>>Import Scheme```
@@ -30,7 +44,7 @@ If you would like to contribute, please keep in mind the following rules:
 - After adding/updating open source dependencies run `gradlew updateLicensesJson` to update attributions.
 
 Internally our CI automatically checks all pull requests for code style issues, and runs our tests. However you can run those locally as well.
-```bash
+```
 gradlew checkstyle
 gradlew detekt
 gradlew test
@@ -39,41 +53,24 @@ gradlew androidTest
 
 By making a contribution to this project you agree to the following:
 
-1. I assign any and all copyright related to the contribution to Proton Technologies AG;
+1. I assign any and all copyright related to the contribution to Proton AG;
 2. I certify that the contribution was created in whole by me;
 3. I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it) is maintained indefinitely and may be redistributed with this project or the open source license(s) involved.
 
-## Manage Image for the CI
-
-### Create an image NAME_IMAGE:branch-<branch>
-
-```sh
-$ make image [branch=name]
-```
-
-### For the dev ~ Build the image on your computer: output ci-android:latest
+## Signature
 
-```sh
-$ make local
+All our builds (except for F-droid) will be signed with same key.
+SHA256 fingerprint for signing certificate
 ```
-
-### Run the image built via make local on your compute so you can inspect its content
-
-```sh
-$ make debug-local
-```
-
-### Deploy the image of the CI from your computer
-
-```sh
-$ make deploy-local: login-deploy imag
+ch.protonvpn.android
+DC:C9:43:9E:C1:A6:C6:A8:D0:20:3F:34:23:EE:42:BC:C8:B9:70:62:8E:53:CB:73:A0:39:3F:39:8D:D5:B8:53
 ```
 
 ## Versioning
-- Version matches format: `[major][minor][patch]`
+- Version matches format: `[major][minor][patch][hotfix]`
 
 ## License
 
 The code and datafiles in this distribution are licensed under the terms of the GPLv3 as published by the Free Software Foundation. See <https://www.gnu.org/licenses/> for a copy of this license.
 
-Copyright (c) 2019 Proton Technologies AG
+Copyright (c) 2019 Proton AG
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		# This file was created to make grype job always pass.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		# ownership: tight
		* @ProtonVPN/groups/android-developers