# Android Insecure Data Storage

> Detects sensitive data stored in plaintext in SharedPreferences, SQLite databases, or external storage in Android applications.

- Skill: `zakirkun/android-insecure-data-storage` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/android-insecure-data-storage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/android-insecure-data-storage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/android-insecure-data-storage

---


# Android Insecure Data Storage

## Overview
Android applications commonly store sensitive data insecurely:
1. **SharedPreferences plaintext**: Tokens, passwords, PII stored in XML files readable on rooted devices
2. **External storage**: Files on SD card readable by all apps with READ_EXTERNAL_STORAGE permission
3. **SQLite without encryption**: Sensitive data in databases accessible after physical extraction
4. **Logcat logs**: Sensitive data logged and accessible via `adb logcat`
5. **Clipboard**: Sensitive data copied to clipboard accessible by other apps

## Detection Strategy
- `SharedPreferences.edit().putString("password", ...)` — storing sensitive values in plain SharedPreferences
- `Environment.getExternalStorageDirectory()` — writing to external storage
- `Log.d/i/v/w/e` with sensitive parameter values

## Remediation
- Use Android Keystore System for cryptographic keys
- Use EncryptedSharedPreferences (Jetpack Security library)
- Store sensitive files in internal storage with MODE_PRIVATE
- Use SQLCipher for encrypted database storage
- Never log sensitive data