QuickCrate is an offline demonstration, not a production commerce service. Security work should preserve its small attack surface and never imply that fixture authentication/payment is real.

The current main branch and latest published source release are supported for security fixes. No signed binary distribution channel currently exists.

For a potential vulnerability, use GitHub's private vulnerability reporting/security advisory flow for the repository when available. Do not publish secrets, exploit details, personal data, or an active vulnerability in a public issue before coordination.

Include:

• Affected commit/tag and Android/API environment.
• Reproduction steps and expected/actual behavior.
• Impact and whether app-private fixture data, file access, intents, or dependencies are involved.
• A minimal suggested mitigation if known.

• The manifest intentionally declares no INTERNET or ACCESS_NETWORK_STATE permission.
• The app has no HTTP client, backend, remote image, analytics, auth provider, payment provider, or runtime URL.
• Phone, OTP, address, profile, order, and payment values are demo fixtures.
• Mutable data is stored in the app-private Room database and is removed when Android app storage is cleared/uninstalled.
• No environment variable or secret is required to build/run the demo.
• Signing keys, .env, local.properties, and keystores must never be committed.

• Accidental network capability or data exfiltration.
• Exported component/intent issues.
• Unsafe file/database exposure or backup behavior.
• Dependency vulnerabilities relevant to the shipped app.
• Duplicate/corrupt order creation or checkout consistency flaws.
• Sensitive data or secret accidentally committed to the repository/release.
• Tampering that violates price, cart, or persisted snapshot integrity.

• Bypassing the hardcoded demo phone/OTP.
• Triggering the explicit Fail next attempt control.
• Mock UPI/card/cash behavior.
• Fixture addresses/profile/orders being visible inside the demo account.
• Missing server-side controls, because no server exists.

If QuickCrate gains networking, real identity/payment, user-supplied files, location, notifications, or binary distribution, replace this policy with a production threat model and coordinated disclosure process before release.

• Run scripts/verify-offline.sh and inspect APK permissions before releases.
• Review dependency updates and generated manifests.
• Scan staged changes for credentials/private keys/tokens.
• Keep GitHub secrets out of logs and local credentials out of agent output.
• Do not publish unsigned debug APKs as trusted release artifacts.