diff --git a/lib/src/main/AndroidManifest.xml b/lib/src/main/AndroidManifest.xml
index 6bb79fc..d18f651 100644
--- a/lib/src/main/AndroidManifest.xml
+++ b/lib/src/main/AndroidManifest.xml
@@ -5,12 +5,13 @@
 
     <application>
 
+        <!-- not exported: other apps must not be able to accept/reject certificates (notification PendingIntents run with our UID anyway) -->
         <activity
             android:name=".TrustCertificateActivity"
             android:label="@string/certificate_notification_connection_security"
             android:launchMode="singleInstance"
             android:excludeFromRecents="true"
-            android:exported="true"/>
+            android:exported="false"/>
 
     </application>
 </manifest>
\ No newline at end of file