From c73ac663132d5503dc00cdcf80120c2770c1eb90 Mon Sep 17 00:00:00 2001 From: r-zakarya <82443831+r-zakarya@users.noreply.github.com> Date: Mon, 17 Aug 2026 16:49:06 +0100 Subject: [PATCH] fix(android): the token is stored, not displayed Kept in settings.bin, because the silent refresh needs it and so does the first download on a fresh device - there is no vault to hide it in yet. But it was the only secret on that screen shown in clear, right beside a masked password field, and it is also the least protected of the three: settings.bin is sealed by the no-auth Keystore key, readable without authentication, unlike the vault. Masked now. It is typed once, and reading it back has no use - a wrong token shows up as a 401 in the log, not by squinting at the field. What it opens stays worth knowing: read access to the account's repositories, whose only content is ciphertext. Co-Authored-By: Claude Opus 5 --- android-client/web/app.html | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/android-client/web/app.html b/android-client/web/app.html index c8274a5..4dc656e 100644 --- a/android-client/web/app.html +++ b/android-client/web/app.html @@ -219,9 +219,12 @@ + + type="password" autocomplete="off">