hardened_malloc is a security-focused replacement for the C heap allocator, compiled as a shared library and used either via LD_PRELOAD or integrated directly into a libc such as Bionic on GrapheneOS. It implements the full malloc family (malloc/calloc/realloc/free, posix_memalign/aligned_alloc, malloc_usable_size) plus hardened extensions such as malloc_object_size, free_sized, and free_aligned_sized, along with C++ operator new/delete wrappers. Its architecture is a single monolithic C library: all mutable allocator state lives in one read-only-after-init metadata region; slab allocations are partitioned into per-size-class regions inside statically reserved address space, and large allocations are mmap-backed with randomized guard pages and a quarantine. It targets 64-bit Linux and currently builds against Bionic, glibc, and musl.
This is an Android PDF viewer application built with Jetpack Compose that uses Mozilla's pdf.js library for rendering. The app displays PDFs in a sandboxed WebView with strict security policies, handles encrypted PDFs, provides navigation controls, outline viewing, document properties, and various UI features like zoom, rotation, and text layer visibility. The architecture follows MVVM with a ViewModel managing state and a Compose UI layer. The app uses content providers to securely load PDF content without granting the WebView access to files or network.
Vanadium is a hardened fork of Chromium for Android, developed by GrapheneOS. It serves as both the default browser and the system WebView provider on GrapheneOS devices. The repository contains a large set of patches (over 300) applied to the Chromium source tree, modifying default settings to enhance privacy and security: disabling telemetry, network prediction, third-party cookies, safe browsing, sign-in, media router, background sync, sensors, and many other features. It enables strict security policies like HTTPS-only mode, strict site isolation, partitioned connections, and Do Not Track. The build system uses GN with custom extension files to inject downstream code into Chromium targets. A separate 'config APK' delivers runtime feature flags and ad-blocking filter lists. The repository also includes patches for GrapheneOS-specific OS integration (custom permissions, connectivity checks, seccomp-bpf sandboxing). The codebase is actively maintained with frequent rebases to upstream Chromium, but the high patch count introduces significant merge conflict risk.
The banking-apps-compat-report repository is a crowdsourced initiative that tracks the compatibility of international banking apps with GrapheneOS by leveraging GitHub issues as a data collection mechanism. Rather than containing traditional source code or data processing pipelines, the project relies on users submitting detailed compatibility reports through a standardized issue form, which are then curated and published by maintainers on the PrivSec.dev website. The cornerstone of this repository is the GitHub issue template located at .github/ISSUE_TEMPLATE/app_report.yml. This template defines a comprehensive form for collecting structured data on banking app compatibility, including fields for app metadata, device and profile specifications, security settings (such as exploit protection and memory tagging), installation methods, NFC payment functionality, and user-reported issues. Its careful design ensures consistent and high-quality data input, making it a reusable asset for similar crowdsourced data collection efforts in other domains. The project is actively maintained, with recent commits and ongoing issue triage, and exhibits low technical drift due to its minimal dependencies and use of stable GitHub features. However, reproducibility of the published compatibility lists is limited because the raw data resides exclusively in the GitHub issue tracker and is not bundled within the repository. Despite this, the initiative successfully provides a valuable, community-driven resource for GrapheneOS users seeking reliable information on banking app functionality.