From 0e497e4f2512485d2a92e2647d3fa68e133aa78b Mon Sep 17 00:00:00 2001
From: Sunik Kupfer <kupfer@bitfire.at>
Date: Tue, 27 Oct 2026 13:57:50 +0100
Subject: [PATCH] Don't export TrustCertificateActivity

---
 lib/src/main/AndroidManifest.xml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/src/main/AndroidManifest.xml b/lib/src/main/AndroidManifest.xml
index 6bb79fc..d18f651 100644
--- a/lib/src/main/AndroidManifest.xml
+++ b/lib/src/main/AndroidManifest.xml
@@ -5,12 +5,13 @@
 
     <application>
 
+        <!-- not exported: other apps must not be able to accept/reject certificates (notification PendingIntents run with our UID anyway) -->
         <activity
             android:name=".TrustCertificateActivity"
             android:label="@string/certificate_notification_connection_security"
             android:launchMode="singleInstance"
             android:excludeFromRecents="true"
-            android:exported="true"/>
+            android:exported="false"/>
 
     </application>
 </manifest>
\ No newline at end of file