zcash-android-wallet-sdk icon indicating copy to clipboard operation
zcash-android-wallet-sdk copied to clipboard

[SDK audit] Recommendation: Confirm that tracing is turned off for release builds

Open HonzaR opened this issue 10 months ago • 0 comments

Is your feature request related to a problem? Please describe.

In backend-lib/src/main/rust/lib.rs there is code for enabling tracing of the Rust code:

Screenshot 2024-04-23 at 16 48 58

Describe the solution you'd like

Double-check that trace information is not generated and saved in release builds, since logs of tracing information could reveal details of private actions the user takes.

Alternatives you've considered

Additional context

We've already checked the production wallet build with the production SDK included, and it didn't reveal any tracing logs for create-new-wallet or restore-wallet-and-send use cases. See the attached logs below (the logs come from all device log tray filtered on zcash keyword):

HonzaR avatar Apr 23 '24 14:04 HonzaR