This document outlines security best practices for the Adati project.

The following files should NEVER be committed to the repository:

• key.properties - Android signing configuration
• *.jks, *.keystore - Android keystore files
• local.properties - Local Android SDK paths
• *.p12, *.pem - Certificates and private keys
• *.mobileprovision - iOS provisioning profiles
• Any file containing passwords, API keys, or tokens

These files are already listed in .gitignore and .gitattributes for additional protection.

To verify no sensitive files are tracked in git:

git ls-files | grep -iE "(env|key|secret|password|token|credential)"

This should return nothing. If it returns files, remove them immediately:

git rm --cached <file>
git commit -m "Remove sensitive file"

• Never commit your keystore file (.jks or .keystore)
• Never commit key.properties with real values
• Store keystore files in a secure, backed-up location
• Use key.properties.example as a template only

See android/SIGNING.md for detailed signing setup instructions.

1. Review before committing: Always review git status and git diff before committing
2. Never hardcode secrets: Never hardcode secrets in source code
3. Rotate credentials: If any secret is exposed, rotate it immediately
4. Use .gitattributes: Additional protection layer (already configured)
5. Regular audits: Periodically check for accidentally committed secrets

If you accidentally commit sensitive information:

1. Immediately rotate the exposed credentials
2. Remove from git history using:

   git filter-branch --force --index-filter \
     "git rm --cached --ignore-unmatch <file>" \
     --prune-empty --tag-name-filter cat -- --all

   Or use BFG Repo-Cleaner
3. Force push (coordinate with team first):

   git push origin --force --all

4. Notify team members to re-clone the repository

• GitHub Security Best Practices
• OWASP Mobile Security
• Flutter Security

If you discover a security vulnerability, please DO NOT open a public issue. Instead:

1. Email the maintainer directly
2. Or create a private security advisory on GitHub

We will respond promptly and work with you to resolve the issue.