`lib/services/private_account_store.dart` persists `username`, `password`, and `totpSecret` side-by-side in `flutter_secure_storage` (Keychain/EncryptedSharedPreferences). This is a deliberate trade-off for the no-server-storage "private mode," and secure storage is the right primitive — but on a rooted/jailbroken device, an attacker with app-data access gets full credential + second-factor bypass in one read, defeating 2FA's purpose.
No code fix strictly required. Consider surfacing this trade-off to the user in the private-mode UI (e.g. a short warning).
Found during the Aug 2026 security sweep.
`lib/services/private_account_store.dart` persists `username`, `password`, and `totpSecret` side-by-side in `flutter_secure_storage` (Keychain/EncryptedSharedPreferences). This is a deliberate trade-off for the no-server-storage "private mode," and secure storage is the right primitive — but on a rooted/jailbroken device, an attacker with app-data access gets full credential + second-factor bypass in one read, defeating 2FA's purpose.
No code fix strictly required. Consider surfacing this trade-off to the user in the private-mode UI (e.g. a short warning).
Found during the Aug 2026 security sweep.