M9: Insecure Data Storage
Sensitive data persisted in plaintext — SharedPreferences, SQLite, external storage, or an unprotected Keychain entry.
Why It Matters
On a rooted or jailbroken device, or via a backup extraction, plaintext local storage is trivially readable by anything with file-system access — no exploitation of the app itself is needed once that access exists.
Application to Application Security
Covers auth tokens or PII written to SharedPreferences without encryption, SQLite databases stored unencrypted on external storage, and files written to world-readable locations.
Relation to Software Development
Local storage is often chosen for its simplicity — SharedPreferences.putString is one line — with encryption treated as a later hardening pass that frequently doesn't happen before release.
How Strata Surfaces This
Static analysis of storage API calls and their surrounding context to distinguish credential/PII storage from benign preference values, plus detection of files written to external, world-readable storage.
Developer guidance
Use the platform's encrypted storage primitives (Android Keystore-backed EncryptedSharedPreferences, iOS Keychain) for tokens and PII — never plain SharedPreferences or an unencrypted SQLite file.
Management guidance
Insecure storage findings are usually a design-review gap, not a one-off coding mistake — worth checking whether new features get a storage review before the pattern spreads across the codebase.