From 611c78776e9582d95448fad06a0e6862369eca37 Mon Sep 17 00:00:00 2001
From: avi <avi@aiolabs.com>
Date: Fri, 7 Aug 2026 14:00:40 -0500
Subject: [PATCH] security: disable backups and don't log SMS bodies

- android:allowBackup=false so config (trigger, sound URIs, duration) is not
  extractable via adb backup or auto-restored to another device.
- SmsReceiver no longer logs received message body/sender (could contain
  sensitive content); uses generic debug logs instead.
---
 app/src/main/AndroidManifest.xml                         | 2 +-
 app/src/main/java/com/example/lostmyphone/SmsReceiver.kt | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 7890807..1c425ff 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -27,7 +27,7 @@
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
 
     <application
-        android:allowBackup="true"
+        android:allowBackup="false"
         android:icon="@drawable/ic_launcher"
         android:label="@string/app_name"
         android:supportsRtl="true"
diff --git a/app/src/main/java/com/example/lostmyphone/SmsReceiver.kt b/app/src/main/java/com/example/lostmyphone/SmsReceiver.kt
index a535d0b..e9b9ce2 100644
--- a/app/src/main/java/com/example/lostmyphone/SmsReceiver.kt
+++ b/app/src/main/java/com/example/lostmyphone/SmsReceiver.kt
@@ -29,10 +29,11 @@ class SmsReceiver : BroadcastReceiver() {
         // We only act on a trigger and ignore others; we do NOT call abort() so
         // other applications are not affected by broadcasts we do not handle.
         val (body, sender) = parseMessages(intent) ?: return
-        Log.i(TAG, "SMS from '$sender': '$body'")
+        // Avoid logging message body/sender, which could be sensitive.
+        Log.d(TAG, "Incoming SMS received (running trigger check).")
 
         if (!RingConfig.isConfiguredTrigger(context, body)) {
-            Log.i(TAG, "Not a trigger. Configured text='${RingConfig.triggerText(context)}'")
+            Log.d(TAG, "Message did not match configured trigger.")
             return
         }