vetkit.android.manifest.allow-backup

The Android app explicitly enables android:allowBackup. App data, including tokens stored in SharedPreferences or databases, can be extracted with adb backup or cloud backup.

Last updated: 2026-11-01

Suite: Security

xml

The Android app explicitly enables android:allowBackup. App data, including tokens stored in SharedPreferences or databases, can be extracted with adb backup or cloud backup.

Category: SECURITY · Engine rule severity: INFO

How to fix it

Set android:allowBackup="false", or keep it and exclude sensitive files with android:dataExtractionRules / android:fullBackupContent.

References

https://developer.android.com/privacy-and-security/risks/backup-best-practices

Source: packages/engine/rules/sast/mobile.yml.

Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.