Android Secure Components v3.14.0

Hardened clipboard handling for sensitive values, standardized step-up copy across SCASCA (Strong Customer Authentication). Strong Customer Authentication - a two-factor authentication solution required by PSD2 regulations for when end-users are accessing their payment account sensitive information or initiating transactions. SCA requires at least two of the following: something you know (password), something you have (device), or something you are (biometrics). flows, and a handful of stability fixes.

Security

• Clipboard auto-clear for sensitive values — values copied from secure fields (CVVCVV (Card Verification Value). Card Verification Value - the 3-digit security code printed on a payment card, used to authenticate card-not-present transactions. Weavr returns CVV in tokenized form on `GET /managed_cards/{id}` (with a stepped-up token); the value is only detokenized inside the SDK's secure CVV display component., card number, PINPIN (Personal Identification Number). Personal Identification Number - the numeric code a cardholder enters to authorize chip-and-PIN purchases and ATM withdrawals. PIN is only present on physical managed cards. Weavr returns it tokenized on `GET /managed_cards/{id}` (with a stepped-up token), and the SDK detokenizes it inside a secure PIN display component.) are now automatically cleared from the clipboard after 2 minutes, or as soon as the clipboard content changes. Copy confirmation labels are also now localized.

Changed

• Standardized step-up copy — the step-up screens for each SCASCA (Strong Customer Authentication). Strong Customer Authentication - a two-factor authentication solution required by PSD2 regulations for when end-users are accessing their payment account sensitive information or initiating transactions. SCA requires at least two of the following: something you know (password), something you have (device), or something you are (biometrics). flow (login, payment authorization, beneficiaryBeneficiaryA trusted recipient for payments that includes both information about the business or individual as well as their bank account or instrument details. When using trusted beneficiaries, customers may be allowed to skip Strong Customer Authentication (SCA) when executing Outgoing Wire Transfer or Send transactions, reducing the number of approval steps required. Now referred to as a Trusted Payee. management, password fallback) now use distinct, consistent copy across all supported languages.
• Hardened error response parsing — malformed error payloads from the backend no longer crash the SDK.

Fixed

• Close button color on biometric enrollment/OTP screens — the close button on the biometric enrollment consent and OTP screens no longer renders in the app's decline color, which could appear red for apps with a red declineTextColor. It now correctly uses the app's text color.
• PSAPSA (Push Step-up Authentication). Push Step-up Authentication - the mechanism in our mobile SDKs that delivers a step-up challenge to an enrolled device as a push notification and verifies it with the user's device biometrics. PSA covers device enrollment, biometric login, and biometric verification of SCA challenges for sensitive operations such as outgoing wire transfers or accessing card details. Exposed as `UXComponents.psa` on iOS and Android and via `initializePSA` on React Native. flow cancellation — fixed the PSAPSA (Push Step-up Authentication). Push Step-up Authentication - the mechanism in our mobile SDKs that delivers a step-up challenge to an enrolled device as a push notification and verifies it with the user's device biometrics. PSA covers device enrollment, biometric login, and biometric verification of SCA challenges for sensitive operations such as outgoing wire transfers or accessing card details. Exposed as `UXComponents.psa` on iOS and Android and via `initializePSA` on React Native. flow swallowing coroutine cancellation, so it now propagates correctly (e.g. when a hosting screen is dismissed mid-flow).