Add MASTG-KNOW-0x01: Android DataStore knowledge article

[Copilot]

DataStore is the recommended replacement for SharedPreferences but lacked a knowledge article, leaving tests and techniques without a reference target.

Changes

• New file knowledge/android/MASVS-STORAGE/MASTG-KNOW-0x01.md
  • Describes both DataStore variants: Preferences DataStore (key-value) and Proto DataStore (typed protobuf objects)
  • Documents storage paths (/data/data/<pkg>/files/datastore/*.pb), binary protobuf format, and default lack of encryption
  • Covers the coroutine/Flow-based read/write API with short Kotlin snippets for both variants
  • Notes how the Serializer can be wrapped with Android Keystore or Tink for at-rest encryption
  • Documents Auto Backup inclusion behavior and opt-out mechanisms
  • Uses fake ID MASTG-KNOW-0x01 per project convention for new knowledge pages pending merge

[kx7m2qd]

Reviewed the knowledge file overall good coverage. A few observations:

1. Accuracy — The storage paths, protobuf format description, and coroutine/Flow API overview are all correct.
2. Missing detail — Worth noting that DataStore is not suitable for large or complex datasets. The official docs recommend Room for relational data. This distinction helps readers choose the right storage solution.
3. Security note — The encryption section is accurate but could mention that wrapping the Serializer with Tink is the recommended approach per Google's own guidance, not just an option.
4. available_since: 21 — DataStore itself was introduced in API level 23+ in practice (it requires coroutines/Kotlin). Worth double-checking if API 21 is accurate.
5. Minor — The backup section correctly covers both android:fullBackupContent (pre-31) and android:dataExtractionRules (31+). Good catch.
   Overall solid foundation for the knowledge article!

[cpholguera]

@kx7m2qd could you please disclose the use of AI in this PR review?

[kx7m2qd]

Hi @cpholguera, I used Claude (an AI assistant) to help structure my review comments. The technical observations are based on my own reading of the file and knowledge of Android DataStore, but I did use AI assistance to help phrase and organize the feedback. I should have disclosed this upfront apologies for not doing so.

[cpholguera]

Thank you for the clarification. If there's anything to change in the PR please always prefer inline suggestions as per our review guidelines. You should review and do the required additional research and confirmations yourself and then indicate the exact line or paragraph changes needed instead of posting a high level review comment. When doing so, e.g. when indicating something like an API level you must always accompany this with a reference URL from the official documentation (in this case the Android developer docs)

https://mas.owasp.org/contributing/3_PRs_and_Reviews/#how-to-review-a-pr

Please let me know if you have any questions.

[kx7m2qd]

Thank you for the guidelines @cpholguera understood completely.

I'll redo the review properly:

1. Switch to inline suggestions on the specific lines rather than high-level comments
2. Look up and link the official Android developer docs for the API level claim before making it
3. Do my own research and verification before posting rather than relying on AI to structure observations

I'll post updated inline suggestions shortly

[kx7m2qd]

Reviewed the file with inline comments on specific lines. Corrections and suggestions cover a removed API reference, a broken link in a code snippet, scope limitation for large datasets, encryption guidance, and a backup security note. Also correcting my earlier top-level comment on available_since: 21 it is accurate as-is.

[cpholguera]

Thanks @kx7m2qd , however this isn't following the guidelines yet. Please use the "Suggested Changes" feature from GitHub as indicated.

[kx7m2qd]

Suggested change

	- **Preferences DataStore**: stores and accesses untyped key-value pairs, similar to `SharedPreferences` but without an XML schema.
	- **Preferences DataStore**: stores and accesses untyped key-value pairs, similar to `SharedPreferences` but without an XML schema. DataStore is designed for small, simple datasets — for large or relational data, [Room](https://developer.android.com/training/data-storage/room) is recommended.

Added scope limitation per official docs.
Reference: https://developer.android.com/topic/libraries/architecture/datastore

[kx7m2qd]

Suggested change

	Neither Preferences DataStore nor Proto DataStore encrypts data at rest by default. The `Serializer` can be wrapped with custom encryption logic using the [Android Keystore](https://developer.android.com/training/articles/keystore) or a library such as [Tink](https://developers.google.com/tink) to encrypt data at rest.
	or the [Tink](https://developers.google.com/tink) library, which is Google's recommended solution for encrypting DataStore data at rest.

Tink is Google's specifically recommended library for DataStore encryption, not just one option among many.
Reference: https://developer.android.com/topic/security/data

[cpholguera]

Please review, some suggestions are completely wrong replacing all contents or adding partial content.