Insecure Data Storage
Protect local data.
Insecure Data Storage is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Local Data
Mobile apps store data on the device: settings, cached content, tokens, and sometimes personal information.
How this local data is stored decides whether an attacker can read it.
The Core Risk
Insecure data storage means sensitive data is saved where it can be read in plain text.
If the device is lost, stolen, or rooted, that data is exposed.
Common Storage Locations
Apps save data in several places:
- Key-value preferences
- Local databases like SQLite
- Plain files
- Logs and caches
Each can leak if used carelessly.
Plaintext Preferences
Storing a token in plain preferences is risky:
prefs.putString("auth_token", token)On a rooted device this file is readable. Sensitive values should never sit here unencrypted.
Use the Keystore and Keychain
Each platform offers secure, hardware-backed storage for secrets:
- Android Keystore
- iOS Keychain
Store tokens and keys here, not in plain files.
Encrypt Sensitive Data
When you must store sensitive data yourself, encrypt it first.
Use platform-provided encrypted storage so the key is protected by the device's secure hardware.
Beware of Logs
Logging is a sneaky leak source.
log("User token: " + token)Logs may be readable by other tools or saved in crash reports. Never log secrets.
Watch the Clipboard
Copying a password or token to the clipboard exposes it to other apps that can read clipboard content.
Avoid placing secrets there, or clear them quickly.
Caches and Backups
Sensitive data can leak through automatic backups and image or web caches.
Exclude secret files from backups and avoid caching sensitive screens.
Store Less
The safest data is data you never store.
Keep sensitive items only as long as needed and delete them after use. Less stored data means less to leak.
Defense in Depth
Combine protections: secure storage, encryption, no secrets in logs, and minimal retention.
If one layer fails, the others still guard the data. That is defense in depth.
Quick Check
Where should an auth token be stored on a mobile device?
Recap
Insecure storage exposes data on lost or rooted devices. Use the Keystore/Keychain, encrypt sensitive data, keep secrets out of logs and the clipboard, exclude them from backups, and store as little as possible.
Frequently asked questions
Is the “Insecure Data Storage” lesson free?
Yes — the full text of “Insecure Data Storage” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Insecure Data Storage”?
Protect local data. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Insecure Data Storage” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Mobile Threat Landscape
- Insecure Data Storage
- Reverse Engineering Apps
- Secure Mobile Coding