Android File Permissions: Sandbox Access Is Not a Storage Permission

Choose the storage location first

The storage overview explains these models. Choose by ownership and sharing requirements, not by which path is easiest to concatenate into a string.

Treat a content URI as a URI

A document picker may return a content:// URI. Use ContentResolver to open it under the granted access rather than assuming it maps to a readable filesystem path. Some providers are remote or virtual and may not expose a stable local path at all.

Handle cancellation, unavailable providers, read failures and files larger than expected. Stream data where possible instead of reading an unbounded document into memory.

Keep private data private

Do not make internal files world-readable to solve an integration problem. Use documented sharing mechanisms with narrow URI grants and appropriate lifetime. Validate filenames and destinations when importing archives or user-controlled data.

Android security guidance should inform decisions about sensitive data, backups and temporary files. Storage convenience is not a reason to expose tokens or private documents.

Diagnose access failures by layer

A permission denial, missing URI grant, nonexistent path and scoped-storage restriction are different failures. Record the URI scheme, operation and relevant API version without logging the document's private contents.

Audit with the correct expectation

APKLint can review manifest storage declarations, but it cannot determine every file the app reads or whether a particular provider grants access. Test actual open, read, write and revoke flows on representative devices. A clean manifest scan is not proof of safe file handling.