This app runs on a car. It reads vehicle data and holds credentials for a third-party service, so security reports are welcome and taken seriously.

Please do not open a public issue for a vulnerability. Use GitHub's private vulnerability reporting instead.

Include what you were able to do, on which firmware generation, and whether the vehicle was moving. A proof of concept helps; a working exploit is not required.

• Anything that lets another app on the head unit read the stored ABRP credentials.
• Anything that gets attacker-controlled code installed through the unstable updater.
• Anything that makes the app write to the vehicle. It should never write at all — this app is read-only towards the car — so any write path is a bug by definition.
• Telemetry that leaks credentials into logs, URLs or crash reports.

• Requiring physical access to an unlocked head unit with developer mode enabled.
• The stable channel not auto-updating. That is deliberate; see LICENSE.md and the README's channel table.
• Vulnerabilities in the OEM firmware itself. Report those to SAIC.

• Credentials live in EncryptedSharedPreferences and are sent in a POST body, never a URL. allowBackup is off and both preference files are excluded from backup rules.
• The unstable updater accepts an APK only over https, only from an exact-match GitHub host allowlist, and only when its signing certificate matches the running app's. All three checks fail closed. The stable channel does not contain the updater at all.
• The VHAL probe helpers, which enumerate the whole vehicle abstraction layer, exist only in debug builds.