Only the most recent release receives security updates. Users should keep their apps updated by downloading new releases from the official repository.

We take the security of AndroLLM seriously. If you discover a security vulnerability, please report it responsibly.

Do NOT create a public GitHub issue for security vulnerabilities.

Instead, report via:

1. GitHub Security Advisories: Use the "Report a vulnerability" button on the AndroLLM repository
2. Email: Send details to the maintainers at the email listed in the repository's package.json or commit history

When reporting a vulnerability, please include:

• A clear description of the vulnerability
• Steps to reproduce the issue
• The impact (what an attacker could achieve)
• Your preferred contact method for follow-up questions
• Allow 72 hours for an initial response before following up

• Acknowledgment: We will acknowledge receipt of your report within 48 hours
• Assessment: We will evaluate the severity and provide a timeline for a fix
• Fix: We will work to resolve the issue and publish a security advisory
• Credit: We will credit reporters in the advisory (unless they prefer anonymity)

All cloud provider API keys are encrypted using Android Keystore-backed AES-256/GCM. The encryption key never leaves the secure hardware enclave where available.

• Implementation: core/cloud/security/KeyCipher.kt
• The raw plaintext key is never persisted to disk or shared preferences
• In memory, keys are only decrypted at the point of use and immediately cleared

• Firebase Authentication is used for optional user sign-in
• Google Sign-In uses Credential Manager with GetGoogleIdOption
• GitHub Sign-In uses Firebase OAuth with scoped permissions (read:user, user:email)
• Sessions persist across app restarts via Firebase Auth state listeners
• Guest mode is always available without authentication

• Room database files are stored in the app's private sandbox (/data/data/io.androllm.app/)
• Model files (.litertlm) are stored in the app's internal storage directory
• Memory embeddings are stored in a separate Room database instance in the same sandbox
• No data is encrypted at rest beyond the Android sandbox boundary (user-controlled feature placeholder)

• Cloud provider requests use HTTPS exclusively; HTTP is rejected
• OkHttp client enforces TLS 1.2+ with certificate pinning readiness
• The android:usesCleartextTraffic="false" default applies
• Streaming responses use SSE with X-Accel-Buffering: no to prevent proxy buffering delays

The project uses the following dependency categories tracked for security:

⚠️ The project currently has a release keystore file (androllm-release.jks) committed to the repository. This must be removed from the repository and added to .gitignore before any public release.

Recommended steps:

1. Add *.jks and *.keystore to .gitignore
2. Move the keystore to a secure location outside the repo
3. Reference it via local.properties or environment variables for builds
4. Rotate the keystore if any commits containing it are public

.litertlm model files can be downloaded from untrusted sources (HuggingFace, direct URLs). The app validates container headers via LiteRtValidator.kt and runs a post-load coherence probe, but does not perform full model integrity checks. Users should:

• Only download models from trusted sources (the bundled litert-community catalog)
• Verify SHA-256 checksums when provided by the model author
• Be aware that malicious model files could exploit the LiteRT-LM/LiteRT runtimes

The voice assistant requires RECORD_AUDIO and runs as a foreground service. This is legitimate functionality but users should be aware:

• The service runs continuously while active (visible notification)
• Barge-in uses energy-based VAD, not cloud processing
• No audio is transmitted to any server during local voice operation

If the vulnerability affects upstream dependencies (LiteRT-LM, sherpa-onnx, etc.), we will also coordinate disclosure with those projects.

• Google Android Security Documentation
• Firebase Security Guidelines
• OWASP Android Security Checklist
• Cryptography Best Practices for Android