fix security issues

Author: denischilik

.mobsf

@@ -11,6 +11,8 @@
 
   ignore-rules:
   - webview_javascript_interface  # Intentional: JS bridge for mParticle WebView SDK; workspace token controls access
+  - android_manifest_insecure_minsdk_error  # Example apps; SDK minSdk 14+ per AGENTS.md
+  - android_manifest_allow_backup  # Example apps only; acceptable for demo/debug
   - hardcoded_api_key
   - hardcoded_username
   - android_kotlin_hardcoded

kits/braze/braze-38/example/src/main/AndroidManifest.xml

@@ -3,7 +3,7 @@
     package="com.mparticle.kits.braze.example">
 
     <application
-        android:allowBackup="true"
+        android:allowBackup="false"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"

kits/braze/braze-38/src/test/kotlin/com/mparticle/kits/AppboyKitTests.kt

@@ -31,12 +31,12 @@ import org.mockito.Mockito
 import org.mockito.MockitoAnnotations
 import java.lang.reflect.Method
 import java.math.BigDecimal
+import java.security.SecureRandom
 import java.util.Calendar
 import java.util.Locale
-import java.util.Random
 
 class AppboyKitTests {
-    private var random = Random()
+    private var random = SecureRandom()
 
     private lateinit var braze: Braze.Companion
 

kits/ga/ga-23/src/test/kotlin/com/mparticle/kits/GoogleAnalyticsFirebaseKitTest.kt

@@ -33,8 +33,8 @@ import org.mockito.MockitoAnnotations
 import java.lang.ref.WeakReference
 import java.lang.reflect.Method
 import java.lang.reflect.Modifier
+import java.security.SecureRandom
 import java.util.HashMap
-import java.util.Random
 
 /**
  * Example local unit test, which will execute on the development machine (host).
@@ -44,7 +44,7 @@ import java.util.Random
 class GoogleAnalyticsFirebaseKitTest {
     private lateinit var kitInstance: GoogleAnalyticsFirebaseKit
     private lateinit var firebaseSdk: FirebaseAnalytics
-    var random = Random()
+    var random = SecureRandom()
 
     @Mock
     lateinit var user: MParticleUser

kits/ga4/ga4-23/src/test/kotlin/com/mparticle/kits/GoogleAnalyticsFirebaseGA4KitTest.kt

@@ -35,8 +35,8 @@ import org.mockito.MockitoAnnotations
 import java.lang.ref.WeakReference
 import java.lang.reflect.Method
 import java.lang.reflect.Modifier
+import java.security.SecureRandom
 import java.util.HashMap
-import java.util.Random
 
 /**
  * Example local unit test, which will execute on the development machine (host).
@@ -46,15 +46,14 @@ import java.util.Random
 class GoogleAnalyticsFirebaseGA4KitTest {
     private lateinit var kitInstance: GoogleAnalyticsFirebaseGA4Kit
     private lateinit var firebaseSdk: FirebaseAnalytics
+    private var random = SecureRandom()
 
     @Mock
     lateinit var user: MParticleUser
 
     @Mock
     lateinit var filteredMParticleUser: FilteredMParticleUser
 
-    private var random = Random()
-
     @Before
     @Throws(JSONException::class)
     fun before() {

kits/leanplum/leanplum-7/leanplum-example/src/main/AndroidManifest.xml

@@ -3,11 +3,11 @@
     xmlns:tools="http://schemas.android.com/tools"
     package="com.mparticle.example.leanplum">
     <uses-sdk
-        android:minSdkVersion="10"
+        android:minSdkVersion="14"
         tools:overrideLibrary="com.leanplum, com.google.android.gms"/>
     <application
         android:name=".ExampleApplication"
-        android:allowBackup="true"
+        android:allowBackup="false"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"