XVault — Privacy-First Vault App — 2026
ShippedA vault that can't be talked out of it.
A privacy-first vault hardened against modified-APK impersonation — closed with Firebase App Check and gated Cloud Functions.
What it does
A modified APK can fake almost anything about itself. It can't fake a passing App Check attestation.
Architecture
Every sensitive operation runs through App-Check-gated Cloud Functions — never trusted straight from the client. A Firestore-driven remote control sits on top: kill switches, forced updates, feature flags, no new build required.
Implementation
Play Integrity kept failing in a way that never reproduced the same way twice. I isolated it variable by variable, on-device, until it held — then hardened the release build with R8/ProGuard and Dart AOT obfuscation.
Trade-offs
Gating everything server-side costs latency. It closes an exploit surface client-side checks never could.