What changed

• encrypt StorageHelper values before writing them to disk while keeping SharedPreferences as the persistence backend
• add a dedicated StorageCipher abstraction with Android Keystore-backed AES/GCM encryption in production
• migrate legacy plaintext values on read and clear undecryptable entries instead of returning corrupted state
• add storage regression tests covering encrypted-at-rest writes, plaintext migration, malformed ciphertext cleanup, and existing CRUD/concurrency behavior
• use a JVM AES/GCM fallback cipher in Robolectric so unit tests still exercise encrypted persistence semantics

Why

Local SDK values were being stored as plaintext strings. The right fix was to harden the single storage seam rather than layering ad hoc protection at call sites.

Impact

• device tokens, device IDs, and pending native magic-link flow state are now encrypted at rest
• existing installs migrate stored plaintext values transparently on first successful read
• malformed or undecryptable encrypted entries are dropped instead of surfacing bad data to callers

Root cause

StorageHelper persisted sensitive values directly through SharedPreferences, so any persisted storage entry was written in plaintext.

Validation

• ./gradlew :source:api:testDebugUnitTest --tests 'com.clerk.api.storage.StorageHelperTest' --tests 'com.clerk.api.signout.SignOutServiceTest' --tests 'com.clerk.api.sdk.ClerkDeviceTokenUpdateTest' --tests 'com.clerk.api.magiclink.PersistentPendingNativeMagicLinkStoreTest' --tests 'com.clerk.api.network.middleware.outgoing.VersioningUserAgentMiddlewareTest' :source:api:spotlessCheck :source:api:detekt