chore: release v1.9.48 — audit hardening pass

Bundle the audit pass fixes (clipboard file:// hardening, MCP catalog read cap,
incognito FLAG_SECURE race, SERA vowel-order correction, settings UX/a11y/microcopy)
into v1.9.48 with release notes.

Author: SysAdminDoc

README.md

@@ -1,6 +1,6 @@
 # SwiftFloris
 
-![Version](https://img.shields.io/badge/version-v1.9.47-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![Dictionary imports](https://img.shields.io/badge/dictionary%20imports-local%20files-green)
+![Version](https://img.shields.io/badge/version-v1.9.48-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![Dictionary imports](https://img.shields.io/badge/dictionary%20imports-local%20files-green)
 
 **SwiftFloris** is a privacy-first Android keyboard, forked from FlorisBoard and pushed toward SwiftKey-class multilingual typing without the cloud. It ships under Apache-2.0, holds no `INTERNET` permission, and binds zero accounts.
 
@@ -37,7 +37,7 @@
 
 ## Highlights
 
-| Area | What's in v1.9.47 | Privacy posture |
+| Area | What's in v1.9.48 | Privacy posture |
 |------|-------------------|-----------------|
 | **Autocorrect / prediction** | SCOWL 117k English dictionary, heap-bounded SymSpell d1+d2, bigram + trigram next-word, capitalization-aware completions, contraction handling, instant-remember user-dictionary overlay | On-device |
 | **Multilingual typing** | Bilingual subtype presets (EN+ES / EN+FR / EN+DE), per-token Latin language identification, top-two straddle guard, sentence-local context scoring, opt-in remembered keyboard language per app, and stale-id-safe manual subtype switching | On-device |
@@ -324,6 +324,7 @@ Current SM-S938B / Android 16 baselines record `am start -W` first-render median
 
 The full public release stream lives on [GitHub Releases](https://github.com/SysAdminDoc/SwiftFloris/releases).
 
+- **v1.9.48** (2026-06-14) — Audit hardening pass: the exported share-to-clipboard handler now rejects `file://` URIs (closing a confused-deputy read of the app's own private files); MCP daemon discovery bounds untrusted catalog reads to prevent an out-of-memory denial; incognito `FLAG_SECURE` now reapplies reliably across keyboard restarts; corrected an inverted SERA vowel order in the Ge'ez/Tigrinya transliterators; and several settings polish fixes — a real empty-state message for the privacy audit log, dark/light theme accessibility labels, no more dangling empty headers in Learned entries, and clearer sync-import and update-check wording.
 - **v1.9.47** (2026-06-14) — New one-tap "Full backup" action on the Backup screen ticks every section (preferences, layouts, themes, and all local clipboard items) and writes a dated archive in a single tap — no manual checkbox juggling before a reinstall or migration. Reuses the existing local, no-network backup flow.
 - **v1.9.46** (2026-06-14) — New "Touch calibration" setting (Settings → Typing) exposes Conservative / Normal / Rescue-heavy profiles that tune gap-rescue dead zones and adaptive-touch neighbour correction. Normal reproduces the previously-hardcoded behaviour exactly, so the default is unchanged.
 - **v1.9.45** (2026-06-14) — New optional "CJK mixed-script spacing" setting inserts a boundary space between Han characters and adjacent Latin words or digits (安装 App, 第 3 章). Preference-gated, off by default; the Han boundary requirement keeps Latin/digit-only typing untouched and existing whitespace is respected.
@@ -533,7 +534,7 @@ limitations under the License.
 
 ## Status
 
-🚀 **Active development.** Current release: **v1.9.47** (2026-06-14). The SwiftKey account export window closed on **2026-05-31**; local/on-device migration paths remain documented above.
+🚀 **Active development.** Current release: **v1.9.48** (2026-06-14). The SwiftKey account export window closed on **2026-05-31**; local/on-device migration paths remain documented above.
 
 ---
 

fastlane/metadata/android/en-US/changelogs/2097.txt

@@ -0,0 +1 @@
+Audit hardening pass. Security: the exported share-to-clipboard handler now accepts only content:// URIs and rejects file://, closing a confused-deputy path where another app could make SwiftFloris read its own private files; MCP daemon discovery now bounds untrusted catalog reads so a malicious sibling app can't exhaust memory. Reliability: incognito mode's secure-window flag now reapplies dependably across keyboard restarts. Correctness: fixed an inverted vowel order in the Ge'ez/Tigrinya (SERA) transliterators. Polish: the privacy audit log shows a proper empty-state message, theme entries announce dark/light variants to screen readers, the Learned entries screen no longer shows empty section headers, and the sync-import and update-check wording reads cleanly.

gradle.properties

@@ -15,5 +15,5 @@ projectMinSdk=26
 projectTargetSdk=36
 projectCompileSdk=36
 
-projectVersionCode=2096
-projectVersionName=1.9.47
+projectVersionCode=2097
+projectVersionName=1.9.48