This project has been audited and hardened following the OWASP Mobile Application Security Verification Standard (MASVS). The security improvements apply to data storage, network transport, platform interactions, and code quality.
MASVS-STORAGE
| Measure | Implementation |
|---|---|
| Scoped Storage | Application data resides in app-private directories via Context.getExternalFilesDir(). This prevents other applications from accessing T-UI configuration and logs. |
| Backup Protection | android:allowBackup="false" prevents sensitive data extraction via ADB backups. |
| Secure File Sharing | Uses FileProvider with content URIs instead of vulnerable file:// URIs for inter-app file sharing. |
MASVS-NETWORK
| Measure | Implementation |
|---|---|
| Enforced TLS | android:usesCleartextTraffic="false" disables plaintext HTTP globally. All connections use TLS 1.2+. |
| Secure Endpoints | All internal service endpoints (weather API, connectivity checks) have been upgraded to HTTPS. |
MASVS-PLATFORM
| Measure | Implementation |
|---|---|
| Signature-Level Permissions | Custom permission x.tui.launcher.permission.RECEIVE_CMD with protectionLevel="signature" ensures only apps signed with the same key can send commands to the launcher. |
| Immutable Intents | All system-bound PendingIntents use FLAG_IMMUTABLE to prevent intent redirection attacks (Android 12+ requirement). |
| Receiver Security | All Broadcast Receivers use explicit export flags (RECEIVER_EXPORTED or RECEIVER_NOT_EXPORTED) to prevent unauthorized external triggers. |
MASVS-CODE / MASVS-RESILIENCE
| Measure | Implementation |
|---|---|
| Minification | Release builds use R8/ProGuard (minifyEnabled true) for code shrinking and obfuscation. |
| Resource Shrinking | shrinkResources true removes unused resources from release builds. |
| Foreground Services | Foreground service types (specialUse, mediaPlayback) comply with Android 14 requirements. |
The built-in BusyBox installer verifies downloaded binaries before installation:
- Binaries are sourced from the trusted EXALAB repository
- Downloads are performed exclusively over HTTPS
- Each binary is verified against a hardcoded SHA-256 hash specific to the CPU architecture
- If the hash does not match, the binary is discarded and installation is aborted
The verification logic is implemented in x/tui/launcher/tuils/BusyBoxInstaller.java.
If you discover a security vulnerability, please report it by opening an issue on the GitHub repository. Do not include exploit details in public issues. Use a private disclosure if the repository supports it.