Skip to content

Conversation

@ghsdh3409
Copy link
Member

Summary

This PR introduces significant security and performance improvements to the Monetai Android SDK by:

  1. Removing SharedPreferences dependency and switching to memory-based storage for SDK credentials.
  2. Eliminating sensitive logging by removing HTTP logging interceptor and credential exposure in logs.

These changes ensure SDK keys and user tokens are never persisted on-device or exposed in application logs, reducing risks of reverse engineering, data leakage, and privacy violations.

Changes Made

Credentials Handling

  • BillingManager: Removed SharedPreferences, added constructor injection for sdkKey and userId.
  • ReceiptValidator: Removed SharedPreferences, added constructor injection for credentials.
  • MonetaiSDK: Removed all SharedPreferences usage, credentials now passed directly to billing components.

Logging & Network Layer

  • ApiClient.kt: Removed HttpLoggingInterceptor and okhttp3:logging-interceptor:4.11.0 dependency.
  • ApiRequests.kt: Removed logging of sdkKey, userId, and API request/response objects.
  • BillingManager.kt: Removed detailed credential and purchase payload logging, kept essential flow logs only.
  • build.gradle: Cleaned up dependencies by removing com.squareup.okhttp3:logging-interceptor.

Security Improvements

  • Prevents SDK key and user token exposure through APK decompilation.
  • Eliminates sensitive data from application logs (requests, responses, credentials).
  • Reduces GDPR and data protection violation risks.
  • Credentials exist only in memory and are cleared when the app terminates.

Performance Benefits

  • Removes disk I/O from SharedPreferences.
  • Faster SDK initialization.
  • Optimized direct memory access.
  • Simpler, leaner network configuration without logging overhead.

@ghsdh3409 ghsdh3409 self-assigned this Aug 20, 2025
@ghsdh3409 ghsdh3409 added the enhancement New feature or request label Aug 20, 2025
@ghsdh3409 ghsdh3409 merged commit 288ad29 into main Aug 20, 2025
2 checks passed
@ghsdh3409 ghsdh3409 deleted the feature/change-sdk-logging-logic branch August 20, 2025 13:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant