android-kiosk-browser/CHANGELOG.md

Changelog

All notable changes to the Android Kiosk Browser project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.0.0-MVP] - 2026-02-03

Added

• Fullscreen WebView browser with immersive mode (hides status & navigation bars)
• URL whitelist system with proper domain boundary matching
• Configurable homepage URL via admin settings
• Lock Task Mode support for full kiosk lockdown
• Admin PIN protection (default: 1234) with 3-tap corner unlock
• Auto-launch on boot via RECEIVE_BOOT_COMPLETED receiver
• Idle timeout with automatic return to homepage and session clearing
• Admin settings panel for runtime configuration
• 29 unit tests covering whitelist, idle timer, and config validation

Security

• Fixed whitelist bypass vulnerability (hobbs.farm.evil.com attack vector)
• Proper domain boundary checking: host == domain || host.endsWith(".$domain")

Documentation

• README.md with setup instructions
• TESTING.md with comprehensive QA checklist
• IMPROVEMENTS.md with code review findings

Technical Details

• Language: Kotlin
• Min SDK: 21 (Android 5.0+)
• Target SDK: 34
• Dependencies: AndroidX Core, AppCompat, WebKit, Preference

---

Future Releases (Planned)

[1.1.0] - Remote Management

• Remote configuration updates
• Usage analytics
• Centralized device management

[1.2.0] - Multi-Profile

• Multiple whitelist profiles
• Scheduled profile switching
• Digital signage mode

---

Maintained by the hobbs.farm team: Pluto 🪐, Spirit 👻, Margaret 🌸