Summary

Fixes the three critical issues found in a security scan of the codebase. Scoped to non-breaking changes so CI (./gradlew build aR) still passes.

1. Hardcoded third-party secrets removed from version control (configs.gradle)

The Umeng AppKey and, more importantly, the QQ / WeChat AppSecret values were committed in plaintext. AppSecrets are server-side credentials that should never ship in a client repo. They are now loaded from an untracked keys.properties:

def keysFile = rootProject.file("keys.properties")
def keys = new Properties()
if (keysFile.exists()) { keysFile.withInputStream { keys.load(it) } }
QQ_APP_SECRET = keys.getProperty("QQ_APP_SECRET", "")   // was "9dfd33...", now read from untracked file
// ...same for UMENG_APP_KEY, QQ_APP_ID, WX_APP_ID, WX_APP_SECRET

• keys.properties added to .gitignore
• keys.properties.template added documenting the keys to configure locally
• Missing keys fall back to "", so the build still configures without the file (e.g. in CI)

2. WebView hardening (widget/BrowserView.java)

• setAllowFileAccess(false) + explicitly disable AllowFileAccessFromFileURLs / AllowUniversalAccessFromFileURLs — prevents malicious pages reading app-private files
• MIXED_CONTENT_ALWAYS_ALLOW → MIXED_CONTENT_COMPATIBILITY_MODE
• SSL cert errors: the old handler let the user tap through an invalid TLS cert (MITM risk, flagged by Google Play). Now release builds reject automatically; the manual prompt is kept only for debug builds:

if (!AppConfig.isDebug()) { handler.cancel(); return; }
// debug-only: show dialog to proceed/cancel

3. Dependency CVE (app/build.gradle)

com.google.code.gson:gson 2.8.8 → 2.8.9, fixing CVE-2022-25647 (deserialization DoS).

Other findings (reported, not changed here)

• Signing keystore + password committed (app/AppSignature.jks, app/gradle.properties with StorePassword=AndroidProject). Left as-is because CI's assembleRelease depends on it and it is an intentional throwaway demo key — recommend rotating and externalizing for real projects.
• App-wide cleartext traffic enabled (usesCleartextTraffic="true" + permissive network_security_config.xml) and a demo HTTP video URL — acceptable for a demo template, should be tightened per-domain for production.
• No SQL injection / raw SQL (app uses MMKV + typed HTTP APIs, no SQLite), no CORS/server endpoints (client-only app), and exported components (WXEntryActivity, FileProvider) are correctly configured.

Link to Devin session: https://app.devin.ai/sessions/2c28a8afb17245e0b0f6abe5ccf13245
Requested by: @nozuonodial