From b3911fedd923318f4a6c644b5a4d5a756f89b9a1 Mon Sep 17 00:00:00 2001
From: davotoula <david.kaspar@gmail.com>
Date: Tue, 3 Mar 2026 09:42:43 +0000
Subject: [PATCH] defensive backup rules

---
 amethyst/src/main/res/xml/backup_rules.xml    | 23 ++++++------
 .../main/res/xml/data_extraction_rules.xml    | 35 ++++++++++++-------
 2 files changed, 34 insertions(+), 24 deletions(-)

diff --git a/amethyst/src/main/res/xml/backup_rules.xml b/amethyst/src/main/res/xml/backup_rules.xml
index fa0f996d2..a08293826 100644
--- a/amethyst/src/main/res/xml/backup_rules.xml
+++ b/amethyst/src/main/res/xml/backup_rules.xml
@@ -1,13 +1,14 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-   Sample backup rules file; uncomment and customize as necessary.
-   See https://developer.android.com/guide/topics/data/autobackup
-   for details.
-   Note: This file is ignored for devices older that API 31
-   See https://developer.android.com/about/versions/12/backup-restore
--->
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Defense-in-depth: allowBackup="false" is set in AndroidManifest.xml.
+     These rules provide additional protection if backup is ever enabled. -->
 <full-backup-content>
-    <!--
-   <include domain="sharedpref" path="."/>
-   <exclude domain="sharedpref" path="device.xml"/>
--->
+    <!-- Exclude encrypted secrets (device-bound, can't decrypt on other devices) -->
+    <exclude domain="sharedpref" path="secret_keeper.xml" />
+    <exclude domain="sharedpref" path="." requireFlags="clientSideEncryption" />
+
+    <!-- Exclude all DataStore files (contains encrypted keys and account prefs) -->
+    <exclude domain="file" path="datastore" />
+
+    <!-- Exclude external storage (large, ephemeral) -->
+    <exclude domain="external" path="." />
 </full-backup-content>
\ No newline at end of file
diff --git a/amethyst/src/main/res/xml/data_extraction_rules.xml b/amethyst/src/main/res/xml/data_extraction_rules.xml
index 9ee9997b0..bc72335b9 100644
--- a/amethyst/src/main/res/xml/data_extraction_rules.xml
+++ b/amethyst/src/main/res/xml/data_extraction_rules.xml
@@ -1,19 +1,28 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-   Sample data extraction rules file; uncomment and customize as necessary.
-   See https://developer.android.com/about/versions/12/backup-restore#xml-changes
-   for details.
--->
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Defense-in-depth: allowBackup="false" is set in AndroidManifest.xml.
+     These rules provide additional protection if backup is ever enabled. -->
 <data-extraction-rules>
     <cloud-backup>
-        <!-- TODO: Use <include> and <exclude> to control what is backed up.
-        <include .../>
-        <exclude .../>
-        -->
+        <!-- Exclude encrypted secrets (device-bound KeyStore encryption) -->
+        <exclude domain="sharedpref" path="secret_keeper.xml" />
+        <exclude domain="sharedpref" path="." requireFlags="clientSideEncryption" />
+
+        <!-- Exclude all DataStore files (encrypted keys and account preferences) -->
+        <exclude domain="file" path="datastore" />
+
+        <!-- Exclude external storage -->
+        <exclude domain="external" path="." />
     </cloud-backup>
-    <!--
+
     <device-transfer>
-        <include .../>
-        <exclude .../>
+        <!-- Exclude encrypted secrets (device-bound, unusable on target device) -->
+        <exclude domain="sharedpref" path="secret_keeper.xml" />
+        <exclude domain="sharedpref" path="." requireFlags="clientSideEncryption" />
+
+        <!-- Exclude all DataStore files (encrypted keys and account preferences) -->
+        <exclude domain="file" path="datastore" />
+
+        <!-- Exclude external storage -->
+        <exclude domain="external" path="." />
     </device-transfer>
-    -->
 </data-extraction-rules>
\ No newline at end of file