[SEC-31] (App movil) El flag de demo de build (VITE_DEMO_MODE) puede quedar embebido en el APK release

[ericmt-98]

⚠️ Solo reporte — NO cambies código. Esta es una issue de auditoría de seguridad. La entrega es únicamente el reporte en docs/security-reports/SEC-XX-*.md (resultado, evidencia, reproducción). No modifiques código de la app ni del backend — los fixes los implementa el equipo. Si tienes una propuesta de arreglo, descríbela en la sección Sugerencia de fix del reporte, no la implementes. Los PRs que cambien código de la aplicación no se aceptarán para esta issue (se pedirá separar el reporte del fix).

---

[SEC-31] (App móvil) El flag de demo de build (VITE_DEMO_MODE) puede quedar embebido en el APK de release

Archivo: micopay/frontend/src/utils/demoMode.ts:1-3

Contexto

export const IS_DEMO_MODE = import.meta.env.VITE_DEMO_MODE === 'true';
export const DEMO_QR_PAYLOAD = 'MICOPAY:DEMO:mock_secret_for_ui_preview';

IS_DEMO_MODE se resuelve en tiempo de compilación (Vite inyecta la env var en el bundle). Si el APK
de release se construye con VITE_DEMO_MODE=true (CI mal configurado, .env heredado), los
comportamientos de demo se hornean en producción: QR/secret de demo constante, atajos de UI y rutas que
asumen datos simulados (alineado con el riesgo de servidor SEC-01/SEC-19, pero del lado del cliente/APK).
No hay una guarda en build que impida publicar un APK de release con el flag activo.

Pasos para reproducir

1. Construir el APK de release tal como se distribuye y buscar en dist/assets/*.js el valor efectivo de
   IS_DEMO_MODE / la string MICOPAY:DEMO:mock_secret_for_ui_preview
2. Verificar qué rutas/branches dependen de IS_DEMO_MODE y qué exponen
3. Revisar la configuración de CI/build de release para VITE_DEMO_MODE
4. Proponer una verificación que falle el build de release si el flag está activo

Lo que reportar

• ¿El bundle de release trae IS_DEMO_MODE activo o el secret de demo?
• ¿Qué comportamiento de demo quedaría disponible en producción?
• ¿Hay guarda de build que lo impida?

Severidad estimada: Media — comportamiento de demo embebible en el APK de producción

---

Plantilla: Resultado: · Evidencia: · Reproducible en testnet: sí/no · Sugerencia de fix: (opcional)

---

Cómo entregar

Completa la plantilla docs/security-reports/SEC-31-vite-demo-mode-apk.md con tu resultado, evidencia y entorno, y envíala como PR (el bot de Drips rastrea PRs) o como comentario en este issue. Un asignado por issue.

[manueldezman]

@manueldezman has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

i would like to work on this, will submit a PR within ! hour, kindly assign to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @manueldezman to this issue.

[Olajcodes]

@Olajcodes has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi maintainer, kindly assign this issue to me. I have worked on issue like this before. I believe I'm capable.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Olajcodes to this issue.

[gidadoabdullateef5]

@gidadoabdullateef5 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hola, me gustaría trabajar en este issue. He revisado la descripción y los criterios de aceptación, y estoy seguro de que puedo completarlo satisfactoriamente. Me aseguraré de cumplir con todos los criterios de aceptación y enviaré un PR limpio y bien probado. Por favor, asígnamelo.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @gidadoabdullateef5 to this issue.

[barnabasolutayo-lgtm]

@barnabasolutayo-lgtm has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello Maintainer. I would love to resolve this issue for you quickly. Please assign to me. Thanƙ you

ℹ️ Repo Maintainers: To accept this application, review their application or assign @barnabasolutayo-lgtm to this issue.

[itzabdoull]

@itzabdoull has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi maintainer! I'd love to work on this issue. I have experience with Go, TypeScript, JavaScript, and Python, and I've built scalable backend services, full-stack applications, and automation workflows. I'm comfortable navigating existing codebases, writing clean, maintainable code, and collaborating through GitHub.

This issue matches my skills, and I'm confident I can deliver a high-quality solution while following the project's contribution guidelines. I'd be happy to provide updates throughout the implementation and welcome any feedback during the review process.

Thank you for considering my application!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @itzabdoull to this issue.

[akinboyewaSamson]

@akinboyewaSamson has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi! I’m a full-stack developer with a strong blockchain background. I’d love to handle this issue and can deliver a clean, reliable solution. Kindly assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @akinboyewaSamson to this issue.

[NeduTheDev1]

@NeduTheDev1 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Please assign to me maintainer i can get it done no issues

ℹ️ Repo Maintainers: To accept this application, review their application or assign @NeduTheDev1 to this issue.

[SamixYasuke]

@SamixYasuke has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi Maintainer, I’d like to investigate the VITE_DEMO_MODE release build risk, document the findings in the required security report, and add a build-time safeguard to prevent release APKs from being generated with demo mode enabled.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @SamixYasuke to this issue.

[larryjay007]

@larryjay007 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi Eric, it's me. I had contributed to one of your project earlier. please assign this to me let me work on the issue as well.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @larryjay007 to this issue.