Security

Security Policy

How we handle security vulnerabilities and protect our users.

Important: If you have discovered a security vulnerability, please do not open a public GitHub issue. Instead, follow the responsible disclosure process described below.

Our Commitment

We take the security of OpenDroid and our users seriously. As an open-source project that interacts with sensitive device permissions (Accessibility Service, phone, SMS, system settings), we recognize the importance of promptly addressing security concerns.

Supported Versions

Only the latest release version of OpenDroid is actively supported with security updates.

Version Status
≥ 1.0 (Latest Release) ✓ Supported
< 1.0 (Pre-release) ✗ Not Supported

Reporting a Vulnerability

If you believe you have found a security vulnerability in OpenDroid, please report it responsibly:

Step 1: Contact Us Privately

Send a detailed report to opendroid.ai@gmail.com or yashabalam707@gmail.com with:

Step 2: Our Response

After receiving your report:

Step 3: Disclosure

Once the vulnerability is patched:

Security Best Practices for Users

To ensure the security of your OpenDroid installation:

Scope

The following areas are in scope for security reports:

Out of Scope

Security Philosophy

OpenDroid operates with full Android system permissions (Accessibility, System Settings, Notifications). Consequently, security is engineered directly into our architecture through principle of least privilege, strict input sanitization, and local encrypted storage.

Key Security Features

Local Key Storage

All API keys provided by users (Gemini, OpenAI, Claude, Groq, ElevenLabs) are encrypted at rest with AES-256-GCM using a key generated and held inside the Android KeyStore, never in application memory or plaintext preferences. Older installs that stored credentials in DataStore are migrated to this store automatically; the legacy plaintext value is removed only once the migration succeeds, and is left in place for a later retry if it doesn't (it is not used at runtime once migration has started). Whether the KeyStore key is additionally isolated in dedicated secure hardware (StrongBox/TEE) depends on the device.

Intent & Action Verification

Every high-consequence system action (making calls, sending messages, changing system settings) undergoes strict schema verification before execution to prevent prompt injection or rogue LLM output execution.

Compound Intent Guard

Detects and validates chained actions (e.g. multi-step automation scripts) to prevent unauthorized side-effects.