Security Audit: Tomodoro APK is a Disaster Waiting to Happen
#12 opened on Sep 14, 2025
Repository metrics
- Stars
- (54 stars)
- PR merge metrics
- (PR metrics pending)
Description
Problem Description
This app, Tomodoro, is a walking checklist of what not to do when building for production. Let’s break it down:
⸻
- Abusing QUERY_ALL_PACKAGES Like It’s 2015
Tomodoro requests the QUERY_ALL_PACKAGES permission — the nuclear option that lets an app see every single other app installed on the device. Unless you’re an antivirus, a file manager, or maybe Google itself, this is completely unjustifiable.
For a Pomodoro timer, it’s absurd. This permission alone guarantees rejection from the Play Store, nukes user trust, and opens the door for data-harvesting abuse if the code ever falls into the wrong hands.
⸻
- Missing Modern Signature Schemes
The APK is signed with v1 and v2, but skips v3. In 2025, that’s lazy. Without v3, you’re leaving part of your signing surface stuck in the past, and yes, v1 is still enabled — which means you’re keeping the Janus exploit window alive for Android 5–8 devices. Why bother even updating your target SDK if you’re going to drag ancient baggage along for the ride?
⸻
- Application Data Backup Enabled by Default
No one thought to explicitly disable [android:allowBackup]. Translation: anyone with USB debugging enabled can yank your app data like it’s candy at a parade. That’s not just sloppy — it’s negligent.
⸻
- Broadcast Receiver Exposed with Weak Permissions
The androidx.profileinstaller.ProfileInstallReceiver is exported and “protected” by a system-level permission not even declared in the app. That’s like putting a padlock on your front door but leaving the key taped to the frame. If the OS implementation ever slips, you’ve just handed other apps a free exploit path.
⸻
- Sloppy Data Hygiene • Randomness? Weak. If you’re leaning on predictable number generation, you’re hitting CWE-330 territory — the kind of mistake that makes cryptographers roll their eyes. • Temp files? Unprotected. Sensitive data in temp directories without tight permissions means you’ve basically left your diary open on the kitchen table. • External storage? Public dump. Any app with storage permission could read or overwrite your files. For a “productivity” app, that’s reckless.
⸻
This isn’t just a handful of rookie mistakes — it’s a masterclass in what not to ship. Until these issues are ripped out, fixed properly, and re-signed with modern schemes, Tomodoro has no business on any distribution platform.
Whoever wrote this, get your act together. You’re not building Hello World apps anymore.
Operating System
Android
Video or Screenshot
No response
Related Code (optional)
No response
OS Version
APK scanning Tools
App Version
0.7
App Download Source
Github Releases