Loophole

about

description

Loophole is a one-tap Quick Settings toggle for Android Developer Options. If you're an Android developer, Developer Options is basically always on. But a lot of banking and fintech apps treat that as a red flag and refuse to open, or silently degrade, while it's enabled -- even though you're not doing anything shady, you're just building. The normal fix is: open Settings, find Developer Options, toggle it off, open your banking app, then remember to turn it back on later. Loophole turns that into one tap from the notification shade. Features: * Reads and toggles Developer Options directly via a Quick Settings tile * Optional home screen widget as an alternative to the tile * Simple in-app switch as a fallback / status view * No ads, no analytics, no tracking Setup note: toggling Developer Options programmatically requires the WRITE_SECURE_SETTINGS permission, which Android only allows to be granted manually once via adb (it cannot be requested through a normal runtime permission dialog): adb shell pm grant <applicationId> android.permission.WRITE_SECURE_SETTINGS Full setup instructions are in the project README. A note on permissions: the app does not make network requests and holds no INTERNET permission. However, the manifest does include ACCESS_NETWORK_STATE, WAKE_LOCK, RECEIVE_BOOT_COMPLETED, and FOREGROUND_SERVICE. These come from Jetpack Glance, the framework used to build the home screen widget, which relies on WorkManager internally to schedule widget updates and survive process death. They are a byproduct of the widget framework itself, not of any network or background activity Loophole performs.

publisher

78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d

first seen

2026-10-08T19:32:16.382176+00:00

last event

2026-08-17 06:21 UTC

install

zapstore.dev or any Zapstore-compatible client

source & build

repository

https://github.com/shubhang-d/loophole

arch flags

android-arm64-v8a android-armeabi-v7a android-x86 android-x86_64

manifest

missing

releases (kind 30063)

1 release indexed; latest 1.1.0.

assets & verification

Every app, release and asset event is schnorr-verified (NIP-01 id + signature) before it enters the catalog, and assets are content-addressed by sha256. We subscribe read-only to the catalog relay — never write to it.

1.1.0 — app-release.apk

sha256

3e879776ea92632a88b89a064e48c4a45cdd03599d3ffe189076c255a0c31e3f

size

2.1 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

4

apk cert sha256

3846c26b24208e88d98eb463e97e5e3979b3a3b4440311e00814cb0e64f4ff66

download

app-release.apk

Showing the newest 1 asset descriptor; the full set is in /api/apps/78ce6faa…