[torlando-tech]

Summary

Closes #859.

Combines the existing Sentry privacy audit with bounded, privacy-minimized memory diagnostics for investigating COLUMBA-EE. This adds diagnostic evidence; it does not claim to reproduce or fix EE's underlying heap exhaustion.

Audit and outgoing policy

The previous Android SDK configuration enabled automatic tracing/profiling, UI/system/logcat breadcrumbs, and unrestricted exception messages without a central output allowlist.

• Replace the Android auto-collection dependency with the existing-version core Java SDK (8.31.0), scoped to the sentry flavor only.
• Reconstruct events/envelopes from an explicit allowlist before disk caching and transmission. Keep managed exception types, symbolized code locations, handled state, build/environment/severity metadata, event IDs/timestamps and trusted packaged ProGuard UUIDs.
• Strip exception values, logs/breadcrumbs, paths/source text/locals, user and installation/device IDs, peer IDs, requests/URLs/headers, arbitrary tags/contexts and attachments. Reject all non-event envelope items, including profiles, sessions, transactions, replay, feedback and unknown types.
• Disable build-time tracing/logcat instrumentation and source-context uploads. Remove the obsolete JankStats breadcrumb producer/dependency and shared breadcrumb API.
• Keep useful managed crash capture and sanitized same-build offline retry. Purge the old unrestricted SDK cache before activation; cache cleanup does not traverse selected symlinks or touch identity/message/attachment storage. Build/mapping-mismatched cached reports are dropped instead of being mislabeled.

Consent and memory diagnostics

• Existing onboarding and Advanced settings controls remain opt-in/off by default, with one shared disclosure that also explains connection-IP visibility.
• Configuration alone does not initialize the SDK. Startup checks both authoritative consent and durable startup permission before activation/replay. Interrupted revocation and delayed/stale grant/startup operations cannot authorize a later upload.
• Main app process only: a separate service-process SDK would otherwise retain stale consent after in-app opt-out.
• Consent-scoped 16-sample numeric ring, nominally once per minute: power-of-two Java heap used/committed/limit buckets, utilization deciles, current cache/queue cardinality buckets, observed import/export counts, relative observation uptime and fixed foreground/trim classifications.
• Poll providers only while consented; stable existing caches are re-read after re-enable. Session tickets prevent old operation completions altering new-session counters. No DB scans, collection copies, forced GC, heap dumps, attachments or keep-alive service.
• High-memory warning on observed 80% crossing, recovery below 70%, with a 15-minute per-session warning interval. Collection stops and memory history/pending telemetry clear on opt-out.

Verification

• 16 Sentry privacy/transport/cache/consent tests and 12 deterministic memory-diagnostics tests pass. Existing crash-report-manager, settings/onboarding and migration crypto/import/roundtrip tests pass. After review, reran the Sentry privacy/memory/crash-manager suites and no-Sentry crash-manager/onboarding/settings suites. Added a failing-before/passing-after interrupted-opt-out → restart → delayed startup read → new grant regression, plus actual SDK replay coverage proving unrevoked same-build reports remain eligible for retry.
• Actual production asynchronous HTTP transport exercised against a loopback-only receiver, not live Sentry: decompressed envelope excludes synthetic sensitive canaries; delivered cached envelopes are removed.
• Cache cleanup regression failed before the fix and passes afterward: aliased Android-style parents are accepted, SDK-root/child symlink targets and protected sibling data survive.
• assembleSentryKotlinBackendRelease, assembleNoSentryKotlinBackendRelease and assembleSentryKotlinBackendDebug succeed. Release APKs were built unsigned locally without release credentials or a live DSN.
• Actual optimized no-Sentry ARM64 release APK inspected with its ProGuard mapping: zero io.sentry classes, no Sentry native/JAR entries; its release runtime dependency graph has no io.sentry dependency.
• Sentry release contains the managed uncaught handler/core SDK and zero io.sentry.android classes. Packaged ProGuard UUID asset verified.
• App detekt and Sentry implementation/test source-set ktlint pass. Repository-wide ktlint still has pre-existing advisory violations; no unrelated formatting changes retained.
• Temporary native-canvas Robolectric render smoke exercised opt-in switch and scroll/reachability of Continue; rendered disclosure/controls inspected. Dedicated emulator ADB was unresponsive, so no on-device UI claim. Temporary smoke source removed.
• Read-only security/spec and implementation reviews completed; identified consent/provider issues were fixed and rechecked.

Deliberate limits

• Managed crashes and safe aggregates only: Android/native/ANR/service-process crash collection and performance/replay telemetry are disabled. Crash-free-user analytics based on installation IDs are intentionally unavailable.
• OOM capture remains best-effort; snapshots can be stale and do not identify retained objects. No raw heap upload or invasive crash-time inspection.
• This is privacy minimization, not anonymity: count/timing metadata remains, and the network/Sentry endpoint observes connection IP. Server-side IP retention/enrichment was not changed or verified; already-uploaded historical reports are not retroactively deleted. A request already in flight cannot be recalled.
• No database/schema/backup-format changes. No personal phone access, debug installation over release, data clearing or transfer of personal history. SECURITY.md documents the audit, allowlist, consent behavior and limits; CI now runs Sentry-flavor privacy tests rather than only shared no-Sentry tests.

Refs COLUMBA-EE

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the interrupted opt-out fix prevents revoked reports from replaying after restart.

Summary

The PR limits Sentry reports to approved crash details and bounded memory counts.

• Sentry sends only approved crash details and managed code locations.
• Startup and settings choices control when crash reporting can run.
• Opt-in reports can include a short history of coarse memory and workload data.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[User opts out] --> B[Save denial and cleanup requirement together]
  B --> C[Stop reporting and clear memory samples]
  C --> D[Delete pending SDK reports]
  E[Restart or later opt-in] --> F{Cleanup required?}
  F -->|Yes| D
  D --> G{Deletion succeeded?}
  G -->|No| H[Keep reporting disabled]
  G -->|Yes| I[Clear cleanup requirement]
  I --> J[Enable only with consent]
  F -->|No| J

Loading

_{Reviews (2) · Last reviewed commit: "fix(telemetry): persist revoked-cache cl..." · Reviewed by Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!