Source quality - Githubissues

Android:

AndroidManifest.xml:

[ ] Specifies minimum SDK (Does not explicitly specify a minimum version)
[X] Does not allow debugging (debuggable not set, see https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/AndroidManifest.xml)
[X] Does not allow backups (allowBackup false, see https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/AndroidManifest.xml)
[ ] Minimises permissions requested (See issue #8)
[ ] Minimises exported services
[ ] Minimises exported receivers
[ ] Minimises exported activities
[ ] Minimises exported content providers (See issue #19)
[ ] Does not include debug activities
[ ] Does not include test activities

Network access:

[X] Does not use WebView based UI (No matches for related APIs in source)
[X] Does not allow plain text traffic (Plain text traffic allowed on loopback, see https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/res/xml/network_security_config.xml)
[ ] Uses secure SSL ciphers suites
[X] Pins SSL certificates (nhs.uk is pinned using SHA-256 hash to GlobalSign RSA OV SSL CA 2018, see https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/res/xml/network_security_config.xml)
[x] Pins SSL certificate for debugging (debug-overrides set, see https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/res/xml/network_security_config.xml)
[X] API protection (References https://api.svc-covid19.nhs.uk which resolves to CloudFlare)
[ ] API authentication
[ ] Does not include HTTP links (See issue #20)
[ ] Traffic cannot be profiled via side channels (See issue #37)

Device security:

[ ] Checks for rooting (No matches for related APIs in source)
[X] Code is un-obfuscated (See https://github.com/nhsx/COVID-19-app-Android-BETA/tree/43a167f8dba422fd9001b64f9c4fd82275abb1c8)
[ ] Checks for resigning (No matches for related APIs in source)
[ ] Prevents side-loading (No matches for related APIs in source)
[X] Does not include native code (See https://github.com/nhsx/COVID-19-app-Android-BETA/tree/43a167f8dba422fd9001b64f9c4fd82275abb1c8)
[x] Uses secure hashing functions (See issue #27)
[x] Uses secure HMAC functions (See issue #27)
[x] Uses secure key derivation functions (See issue #27)
[x] Uses secure symmetric cipher suites (See issue #27)
[x] Uses secure asymmetric cipher suites (See issue #27)
[ ] Uses secure elliptic curves (See issue #27)
[ ] Uses secure key storage
[ ] Generates secure random numbers (See issue #16 and #27)
[ ] Safely de-serialises data
[X] Uses prepared statements (See issue #21)
[X] Safely loads XML data (No matches for related APIs in source)
[X] Does not access the cache (No matches for related APIs in source)
[ ] Sanitises uses input
[ ] Does not have verbose logging (Uses Timber)
[ ] Does not include debug code
[ ] Does not include test code
[ ] Performs exception handling (Some exceptions are contain specific, verbose errors)

Data security:

[ ] Minimal data collected at registration
[ ] Minimal user data kept in on-device database (Schema probably needs reviewing to be sure, see issue #21)
[ ] Minimal user data kept in backend database

3rd party tracking:

3rd party code:

Resources:

iOS:

timb-machine / nhsx-contact-tracing-app