Skip to content

fix(security): remove payment token logging from Android Pay sample #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arunmish-visa wants to merge 2 commits into
base: master
Choose a base branch
from
Open

fix(security): remove payment token logging from Android Pay sample #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9ad1cd3
fix(security): remove payment token logging from Android Pay sample
arunmish-visa Jun 30, 2026
1270f19
fix(security): mask CVV input and prevent screen capture in sample app
arunmish-visa Jun 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions app/src/main/java/net/authorize/acceptsdk/sampleapp/CheckoutActivity.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
import android.support.v4.app.FragmentManager;
import android.util.Log;
import android.view.View;
import android.view.WindowManager;
import android.widget.Button;
import android.widget.FrameLayout;
import android.widget.LinearLayout;
Expand Down Expand Up @@ -73,6 +74,12 @@ public class CheckoutActivity extends BaseActivity

@Override protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);

// SECURITY: Prevent screenshots and screen recording to protect sensitive payment data
// (CVV, card numbers) from overlay attacks, screen capture malware, and shoulder-surfing
getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE,
WindowManager.LayoutParams.FLAG_SECURE);

setContentView(R.layout.activity_checkout);
setupViews();
createNetworkTokenPaymentMethodParameters();
Expand Down
5 changes: 2 additions & 3 deletions app/src/main/java/net/authorize/acceptsdk/sampleapp/androidpay/OrderCompleteActivity.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,13 +61,12 @@ private void populateEncryptedBlobs(){
if (paymentMethodToken != null) {
String tokenJSON = paymentMethodToken.getToken();
if (tokenJSON != null) {
Log.d("AndroidPay", "AndroidPay token before encode :" + tokenJSON);
// SECURITY: Do not log payment tokens — they contain encrypted card data
// that could be exposed via logcat, bug reports, or crash-reporting tools.
String blob = getBase64Blob(tokenJSON);
Log.d("AndroidPay", "AndroidPay Blob" + blob);

String anetBlob = createSecServiceJson(blob);
anetBlob = getBase64Blob(anetBlob);
Log.d("ANet OpaqueData Blob" , anetBlob);
androidPayBlobView.setText(anetBlob);
}
return;
Expand Down
3 changes: 2 additions & 1 deletion app/src/main/res/layout/fragment_accept.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,8 @@
android:layout_weight="1"
android:hint="@string/cvv"
android:imeOptions="actionNext"
android:inputType="number"
android:inputType="numberPassword"
android:importantForAutofill="no"
android:maxLength="3"
android:nextFocusDown="@+id/zip_code_view"
android:textSize="32sp"
Expand Down