Android apps write their logs to a file (usually referred to as "logcat") which is very useful not only for developers but also for users who want to investigate problems. You can easily see that hundreds of lines get written to logcat every time you open Facebook, Gmail, Whatsapp, or pretty much any other app.
In all recent Android versions, a logcat line is only visible to the app that wrote it, and to the human user (please correct me if anything is not exact).
As a developer, what should I never output to logcat?
- Dialog that the user opens
- Language choice of the user
- Accessed URL
- Software versions
- User settings
- WiFi name
- User nickname
- Current geolocation
- Credit card number
- Password
- etc
Where to put the limit? What information, if included, would be considered a vulnerability?
Actually, I often see WiFi names in my logcat.
Context: Small open source non-critical app with only a few thousands users, many of whom send bug reports (including logcat) or even help with debugging, I rely on them and because it is a hobby and I don't have much time for testing.
