android/architecture-samples · #1066
[Security] Exported Activity (TodoActivity) without permission protection
1 USDC · Pending fund
GitHub issue
Full description from the linked issue.
Summary
Static analysis found 1 exported activity without permission protection.
File: app/src/main/AndroidManifest.xml:29
Activity: TodoActivity with
External apps can launch this activity with crafted intents.
Fix: Add or validate intent extras in onCreate().
Scanner: semgrep 1.162.0 on proot-distro Ubuntu 25.10
Bounty intelligence
AI estimate — not a guarantee
- Repo about
- A collection of samples to discuss and showcase different architectural tools and patterns for Android apps. These samples feature a TODO app implemented with small differences across branches, demonstrating various architectural approaches.
- Language / stack
- Kotlin, Jetpack Compose, Navigation Compose, ViewModel, Flow, Coroutines, Room, Hilt
- Complexity
- S
- Small — limited scope · AI estimate — not a guarantee
Parallel hunt is coordination only. Optional Working on this does not move money and is not exclusive. Merge is still truth: the winner is the author of the merged pull request that closes the funded issue.
Working on this
Optional, non-exclusive signal. Many hunters can work the same bounty. It does not change eligibility or money.
No hunters have signaled yet. Parallel hunt is open.
Sign in with Google to signal Working on this. Not exclusive.
Pool roster
Eligibility freezes at the winning merge. Rows below may still be unfrozen candidates.
No pool candidates yet. Empty pool → winner receives 100% of post-fee.
Payout breakdown
Frozen 85/15 of post-fee (ADR 0003). Winner Claim pays winner + fee only. Each pool participant Claims their equal share when they have a Settings payout wallet. Already-paid shares show Paid. Unlinked or wallet-less members stay retryable; their share is not redistributed.
Of face
- Fee (2%), hatched · 0.02
- Winner (100% of post-fee), solid · 0.98
Of post-fee
- Winner (100% of post-fee), solid · 0.98
- Face
- 1 USDC
- Fee (2%)
- 0.02 USDC
- Winner (100% of post-fee)
- 0.98 USDC · Claim pending
- Pool (0)
- 0 USDC — empty pool, winner receives 100% of post-fee
- Escrow
- pending · rail cdp
- Poster
Enrique Gamboa
Sign in with Google to fund, add USDC to a funded bounty, signal Working on this, or claim a winner or pool payout.