From 040fefdd4b1d0fe58bd4aa7e1928ecc5c3f43169 Mon Sep 17 00:00:00 2001
From: M57 <41645758+Hy4ri@users.noreply.github.com>
Date: Mon, 20 Jul 2026 17:45:39 +0300
Subject: [PATCH] security: disable Android Auto Backup (issue #636) (#642)

Set android:allowBackup="false" to stop the OS from snapshotting
/data/data/com.m57.hermescontrol/ (server_store.json, SQLCipher DB,
EncryptedSharedPreferences tokens/cookies, PersistentCookieJar) into
the user's Google Drive. Removes a credential + chat-history exfil
surface via Google account compromise.

Co-authored-by: M57 <Hy4ri@users.noreply.github.com>
---
 app/src/main/AndroidManifest.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 976daf96..610dbc73 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -10,7 +10,7 @@
 
     <application
         android:name=".HermesControlApp"
-        android:allowBackup="true"
+        android:allowBackup="false"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"