district-android

The source is in a public git repository on GitHub. https://github.com/distronode-corporation/district-android

Git records every change with its author, date and message, browsable at https://github.com/distronode-corporation/district-android/commits/main

Development happens on main in the public repository through pull requests; every commit between releases is public, not just release snapshots.

The project uses git.

Each release has a unique versionName (the current is 3.0.3), and the versionCode Google Play sees is derived from the commit count; release.yml refuses a tag that does not equal versionName or does not name a commit on main, and tags are protected so they cannot be moved or deleted. https://github.com/distronode-corporation/district-android/blob/main/.github/workflows/release.yml

Releases since 3.0.0 use MAJOR.MINOR.PATCH (3.0.0 to 3.0.3), recorded in CHANGELOG.md; earlier releases used MAJOR.MINOR (2.0 to 2.2). https://github.com/distronode-corporation/district-android/blob/main/CHANGELOG.md

Each release is a protected v* git tag equal to the versionName, and release.yml builds a release only from such a tag. https://github.com/distronode-corporation/district-android/tags

Each release has human-readable release notes in CHANGELOG.md (Keep a Changelog format); the release workflow sends that section to Google Play as the English notes, with French in release-notes/fr-CA, and publishes it as the GitHub Release body. https://github.com/distronode-corporation/district-android/blob/main/CHANGELOG.md

No release has fixed a publicly known vulnerability in the app: the four Dependabot alerts fixed on 2026-09-26 were in Gradle build tooling resolved by settings.gradle.kts, not in anything the app ships. SECURITY.md commits to crediting reporters in the changelog entry for each fix.

Bugs are reported as GitHub issues with the bug report form; CONTRIBUTING.md says what to include and what never to paste, and sends security reports to SECURITY.md instead. https://github.com/distronode-corporation/district-android/blob/main/CONTRIBUTING.md#reporting-bugs

The project uses GitHub Issues. https://github.com/distronode-corporation/district-android/issues

The repository has received no bug reports from outside the project (the issues on file, #20 and #87, were opened by the maintainers, and #20 is fixed and closed); the maintainers watch the issue tracker and acknowledge each report.

No enhancement requests have been received yet; they are answered on the issue tracker or in Discussions.

All issues and pull requests, open and closed, stay publicly searchable on GitHub. https://github.com/distronode-corporation/district-android/issues?q=

SECURITY.md describes how to report a vulnerability, what to include, what is in scope, and the supported versions. https://github.com/distronode-corporation/district-android/blob/main/SECURITY.md

Private reports go through GitHub private vulnerability reporting (enabled), with email to opensource@distronode.com as a fallback, as SECURITY.md describes. https://github.com/distronode-corporation/district-android/security/advisories/new

No vulnerability reports have been received in the last 6 months (no repository security advisories exist). SECURITY.md promises an acknowledgement within a few working days.

The checksum-pinned Gradle wrapper builds the app from source (./gradlew assembleDebug, or ./gradlew :app:bundleRelease for a release bundle signed with your own key); the README gives the commands. https://github.com/distronode-corporation/district-android#build-and-test

The build uses Gradle with the Android Gradle Plugin, the standard tools for an Android app.

Gradle, the Android Gradle Plugin, Kotlin, OpenJDK, detekt and Robolectric are FLOSS, and the Android SDK platform and build tools are built from the Apache-2.0 Android Open Source Project.

The test suite is in the repository under Apache-2.0: JVM unit tests in every module, Compose UI tests under Robolectric, HTTP tests against MockWebServer, and strict contract tests that decode the server's recorded responses. https://github.com/distronode-corporation/district-android/blob/main/CONTRIBUTING.md#the-inner-loop

./gradlew testDebugUnitTest runs every module's unit tests, the standard invocation for an Android Gradle project.

Kover measures aggregate coverage on every CI run and koverVerifyUnit holds it to floors of 99 percent of lines and 98 percent of branches, set just under the measured values. https://github.com/distronode-corporation/district-android/blob/main/build.gradle.kts

GitHub Actions runs the whole gate (detekt, lint, unit tests, the debug build, the coverage floors, the R8 release check and the release-script tests) on every push to main and every pull request. https://github.com/distronode-corporation/district-android/blob/main/.github/workflows/ci.yml

CONTRIBUTING.md holds the project to line and branch coverage floors that only go up and must never be lowered to make a build pass, requires a new module to join the coverage measurement, and the pull request template asks for the tests that were run; new functionality therefore cannot merge without tests. https://github.com/distronode-corporation/district-android/blob/main/CONTRIBUTING.md#the-whole-local-gate

Recent functional changes carry their tests, for example the French scheduling times (pull request #90, four test files) and the phone-number help sentences (#88), and CI fails any change that drops coverage below the floors. https://github.com/distronode-corporation/district-android/pull/90

The policy is in CONTRIBUTING.md and the pull request template, the instructions for change proposals. https://github.com/distronode-corporation/district-android/blob/main/.github/PULL_REQUEST_TEMPLATE.md

Android Lint runs with abortOnError and no baseline, and detekt (with the ktlint formatting rules) runs with maxIssues set to 0, on every module; zizmor lints the workflows. https://github.com/distronode-corporation/district-android/blob/main/config/detekt/detekt.yml

Any detekt finding or lint error fails CI on every push and pull request, and nothing is suppressed by a baseline. The lint warnings that remain are NewerVersionAvailable notes for versions pinned on purpose, each pin explained in gradle/libs.versions.toml.

detekt allows zero issues, lint has no baseline and nothing demoted or disabled, and a check that cannot be fixed may only be disabled by name with its reason in the build logic; lint warnings are not promoted to errors only because of the deliberate version pins above.

The primary developer designed the app around these principles, as the security model in SECURITY.md shows: no password collected (sign-in in a Custom Tab with PKCE), tokens encrypted with a Keystore key that never leaves the device and reads that fail closed, a deliberately small permission surface, push payloads that carry identifiers only, crash reporting off by default and stripped of personal data, and releases built in CI with credentials borrowed for one run. https://github.com/distronode-corporation/district-android/blob/main/SECURITY.md#security-model

The primary developer knows the common error classes for this kind of software and their mitigations; SECURITY.md's scope and model cover token and data leaks through logs, crash reports, notifications, backups, exported components, intents and the clipboard, tokens sent to the wrong host, deep links that act without the user's intent, cross-workspace data mix-ups, refresh token replay and committed secrets, each with its countermeasure. https://github.com/distronode-corporation/district-android/blob/main/SECURITY.md#scope

Only published, reviewed protocols and algorithms are used: TLS through the platform, OAuth 2.0 with PKCE S256 (SHA-256), AES-256-GCM for tokens at rest, and for encrypted rooms LiveKit's frame encryption. https://github.com/distronode-corporation/district-android/blob/main/SECURITY.md

The project implements no cryptography itself; it calls the Android Keystore and the platform's AES/GCM cipher (KeystoreCipher.kt), java.security for SHA-256 and SecureRandom, OkHttp over the platform TLS stack, and the LiveKit SDK for media encryption. https://github.com/distronode-corporation/district-android/blob/main/core/core-auth/src/main/kotlin/com/distronode/districtai/core/auth/KeystoreCipher.kt

All cryptography the app depends on is implemented in FLOSS: Android's Conscrypt and BoringSSL (AOSP, Apache-2.0), OkHttp (Apache-2.0) and the LiveKit SDK and libwebrtc (Apache-2.0 and BSD).

Tokens are encrypted with a 256-bit AES key (KEY_SIZE_BITS = 256 in KeystoreCipher.kt), hashing is SHA-256, and TLS uses the platform's defaults through OkHttp, with which the service negotiates TLS 1.3 and AES-256-GCM. The app exposes no setting that could choose a shorter key.

No broken algorithm or mode is used: no MD4, MD5, single DES, RC4 or Dual_EC_DRBG; encryption at rest is AES-GCM with an IV the Keystore generates for each encryption.

No algorithm with known serious weaknesses is used in the app's own code: no SHA-1 and no CBC mode; hashing is SHA-256 and encryption is AES-GCM.

Every connection is TLS through the platform stack: on Android 10 and later the service negotiates TLS 1.3, which always has forward secrecy, and on older versions ECDHE suites are offered first and preferred.

The app stores no passwords: sign-in happens on the service's own page in a Custom Tab with PKCE, and the app never collects a password. Tokens are encrypted with a Keystore key.

The PKCE verifier and the state come from java.security.SecureRandom (Pkce.kt), and the Keystore generates the AES-GCM key and every IV. https://github.com/distronode-corporation/district-android/blob/main/core/core-auth/src/main/kotlin/com/distronode/districtai/core/auth/Pkce.kt

The app is delivered by Google Play over HTTPS, signed with the app signing key Google Play App Signing holds; builds are made in CI by release.yml with the upload key borrowed for one run. https://github.com/distronode-corporation/district-android/blob/main/.github/workflows/release.yml

No hash is retrieved over HTTP: the Gradle distribution's SHA-256 and the sentry-cli SHA-256 are pinned in the repository, every dependency is locked, and setup-gradle validates the wrapper jar. https://github.com/distronode-corporation/district-android/blob/main/gradle/wrapper/gradle-wrapper.properties

The app has no unpatched vulnerability of medium or higher severity: Dependabot shows no open alerts. One build-time advisory is recorded rather than fixed: GHSA-r937-wjx7-w2jp (CVE-2026-53914, medium) in the Kotlin Gradle plugin, which is not shipped in the app, whose only fix is a pre-release, and which needs a poisoned build cache that this CI does not accept from pull requests; it is tracked in issue #87. https://github.com/distronode-corporation/district-android/issues/87

Dependabot security updates are enabled and Dependabot regenerates every module's lockfile; the critical and high alerts found when the repository was set up were fixed the same day (2026-09-26). https://github.com/distronode-corporation/district-android/blob/main/.github/dependabot.yml

The repository holds no valid private credentials (signing and store credentials are borrowed per run, never stored); gitleaks scans the whole history on every push and pull request, GitHub secret scanning with push protection is enabled with no open alerts, and SECURITY.md lists the public values that look like secrets and are not. https://github.com/distronode-corporation/district-android/blob/main/.github/workflows/gitleaks.yml

CodeQL (advanced setup, Java/Kotlin and Actions) runs on every push to main, every pull request and weekly; detekt and Android Lint run in CI on every push and pull request, with zizmor over the workflows. https://github.com/distronode-corporation/district-android/blob/main/.github/workflows/codeql.yml

CodeQL's Java/Kotlin queries look for common vulnerabilities (injection, intent and content provider exposure, cleartext storage and logging, weak cryptography), Android Lint's security checks look for exported components, insecure WebView and cryptography misuse, and zizmor for workflow injection and over-broad tokens.

Medium and higher findings are triaged as they appear: there are no open CodeQL alerts, and the open code scanning entry is an OpenSSF Scorecard posture check (repository age), not a code finding. Lint errors and detekt findings fail CI.

CodeQL runs on every push to main and every pull request (plus weekly), and detekt and lint on every push and pull request.

The automated suite runs on every change and before every release with measured branch coverage held at 98 percent or more by koverVerifyUnit, above the criterion's 80 percent, and Compose screens are rendered in several states under Robolectric. https://github.com/distronode-corporation/district-android/blob/main/build.gradle.kts

The app is written in Kotlin and contains no memory-unsafe code; native code enters only through third-party libraries (libwebrtc in the LiveKit SDK).

The tests assert invariants on every run, and the code's require and check calls and the strict contract decoder stay on in every build rather than being compiled out.

No medium or higher vulnerability has been found by dynamic analysis; any failing test blocks CI, so a finding is fixed before the change can merge.