Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Document visibly that Stetho should be only present in debug builds #674

Open
petrdvorak opened this issue Dec 30, 2019 · 0 comments
Open

Comments

@petrdvorak
Copy link

To my surprise, we can see quite a lot of banking apps that use Stetho. This is very good since it shows that banks do care about good UI and do on-device debugging. But it is also pretty bad since developers release this on Google Play and as a result, the entire content of the screen is broadcasted via the Stetho build-in server, leaking very sensitive data (accounts, transactions, passwords, and PIN codes, ...).

Please add visible documentation clearly stating that Stetho should be available on non-production builds only, ideally in a specific "UX-debugging flavor" or the app. I know that this is a bit patronizing for some developers but this improvement does not cost anything and might prevent some damages...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant