Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

branchmetrics/branch-android-sdk

              master @ 928ddf2
            

Fixes

CVEs

MEDIUM

Peak severity

50.0%

Coverage

Highlights

Information Disclosure: 1 prior fix. Scrutinize any change in this area.

Branch-SDK-TestBed: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: The test bed application previously exposed sensitive identifiers, including keys and hardware IDs, to public logs via saveLogToFile. Developers must ensure that all logging utilities aggressively strip sensitive metadata and device identifiers.

Insecure Endpoint Routing: Custom user-configured endpoints could override system validation routes, potentially directing sensitive app configuration requests to untrusted servers. The fix enforces a bypass of custom API base URLs for these critical validation calls.