cobalt-ellu

E K

ELLU APPSEC — PROJECT DESCRIPTION + DEVELOPMENT REQUIREMENTS Ellu AppSec is a real Android cybersecurity application built with Kotlin + Jetpack Compose. Product identity: ELLU — AI-powered scam, payment and device protection. This is NOT a UI prototype. Existing real functionality must be preserved. Do not replace working functionality with mock/demo data. TECH STACK - Kotlin - Jetpack Compose - Hilt - Room - DataStore - Firebase Authentication / Firestore architecture - WorkManager - CameraX - ML Kit - Android PackageManager - Android permission/system APIs ARCHITECTURE UI → ViewModel → Use Case → Domain Engine → Repository → Room/DataStore/Firebase/Android APIs Main features: AUTH: - Email/password - Mobile/OTP - Continue without account / Local Mode - Firebase authentication for signed-in users - Local Mode works without Firebase and persists locally HOME: - Security Score - Protection overview - Security Advisor - Recent security events/scans - Quick actions Security Score uses the existing SecurityScoreCalculator and REAL device/app data. SCANNING: - URL/link scanning - UPI/payment scanning - Message/scam analysis - QR scanning - CameraX + ML Kit QR scanner Existing engines: - UrlRiskEngine - UpiAnalyzer - MessageAnalyzer - ScamThreatEngine - ScanUseCase IMPORTANT SECURITY RULE: scammer@ybl MUST NOT be classified SAFE. Do not weaken security engines to satisfy UI tests. PROTECTION: - Notification protection - Device security - App security - Privacy - Network/security status Use real states only. Never display ACTIVE unless actually active. PERMISSIONS: - Camera - POST_NOTIFICATIONS - Notification Listener Use real Android APIs and refresh state when returning from Settings. Unsupported capabilities must remain: NOT AVAILABLE Do NOT fake: - Call Screening - SMS default-app interception - Accessibility interception - VPN filtering - Remote anti-theft APP SECURITY: Use PackageManager to inspect installed apps and permission risks. Use terminology: PERMISSION RISK Do not claim full malware detection unless a real malware engine exists. HISTORY: Room-backed scan/security event history with filtering, risk states, empty state and deletion. REPORT: Real security score, scan counts, risks, protection state and recommendations. Never invent statistics. SECURITY ADVISOR: Uses real device/application state and provides prioritized recommendations. Every recommendation should have a real action where possible. FAMILY: Currently local-only: - Create family - Join family - Invite code - Members - Leave family Clearly show: LOCAL MODE / NOT CLOUD SYNCED Do not fabricate remote members. PRIVACY: - Clear scan history - Clear security events - Clear supported local data - Confirmation dialogs - Refresh counts after deletion APP LOCK: - Set PIN - Confirm PIN - Validate PIN - Change PIN - Disable PIN - Secure hashing/storage Do not claim full process-wide protection if not implemented. SETTINGS: Settings must navigate to real implemented features. No dead buttons. NAVIGATION: Main tabs: Home / Scan / Protection / Family / History Requirements: - Correct selected tab - No duplicate destinations - Home always accessible - Correct Back behavior - Secondary screens pop correctly - Android Back works - Return from Android Settings refreshes state DESIGN DIRECTION: Create a premium commercial cybersecurity visual identity. Use: - deep black/navy background - emerald green - cyan - purple for AI/premium - amber warnings - coral/red threats - subtle gradients - atmospheric glows - premium rounded cards - custom Ellu vector/SVG artwork - strong typography hierarchy - polished animations The app should NOT look like a basic Material/Compose template. Do not copy another company's branding or artwork. Existing Ellu vectors include: ellu_hero_critical ellu_hero_empty ellu_hero_scan ellu_hero_secure ellu_hero_warning and: ellu_ic_shield ellu_ic_shield_secure ellu_ic_shield_warning ellu_ic_shield_critical ellu_ic_link ellu_ic_upi ellu_ic_qr ellu_ic_message ellu_ic_web ellu_ic_device ellu_ic_network ellu_ic_notification ellu_ic_lock ellu_ic_family ellu_ic_report ellu_ic_privacy ellu_ic_radar ellu_ic_app_security Use these as one coherent Ellu illustration system. PREMIUM UI GOAL: HOME: Large Security Score hero + glowing shield + protection widgets + Security Advisor + colourful quick actions + recent activity. SCAN: Premium visual cards for Link, UPI, QR, Message and App Security. RESULTS: Different visual treatment for: SAFE SUSPICIOUS HIGH RISK THREAT DETECTED UNKNOWN Use real risk data. NAVIGATION: Premium floating bottom navigation with: Home / Scan / Protection / Family / Activity Use selected icon glow/pill while preserving existing routes. REUSABLE COMPONENTS: - SecurityScoreHero - ProtectionOverview - SecurityAdvisorCard - QuickSecurityAction - ScanModeCard - ThreatResultHero - SecurityEventRow - PermissionStatusCard - SecurityToolCard - FamilyProtectionCard - PremiumFeatureCard Use consistent spacing: 16–20dp screen padding 14–28dp card radius 52–56dp primary buttons 48dp minimum touch targets Typography: 32–40sp hero 24–28sp screen title 18–20sp section 15–17sp card title 13–14sp supporting text Add subtle animations: - score ring - shield glow - card entrance - button feedback - scan animation - result reveal Do not use animation to fake security operations. REAL DATA RULE: Never invent: - security scores - scan counts - threat counts - family members - protection states - security events - AI recommendations - statistics No data = zero/empty/unknown state. PERFORMANCE: Preserve startup-performance fixes. Do not introduce: - Room on main thread - Firebase blocking startup - WorkManager blocking cold start - large synchronous image loading - expensive Compose recomposition CURRENT KNOWN BUILD ISSUE: Latest Premium Visual Pass has duplicate ElluSpacing: core/designsystem/theme/Shape.kt core/designsystem/theme/Spacing.kt Keep ONE canonical ElluSpacing implementation and remove only the duplicate declaration while preserving all shape/spacing functionality. DEVELOPMENT RULE: Before changing code: 1. Inspect existing implementation. 2. Preserve working functionality. 3. Fix real issues. 4. Use reusable components. 5. Keep real data connected. 6. Do not fake unavailable Android capabilities. 7. Build after changes. 8. Verify on physical Android device. Build command: ./gradlew clean test assembleDebug Do not claim BUILD SUCCESSFUL unless it actually succeeds. Final goal: ELLU APPSEC should become a production-quality Android cybersecurity application combining: SCAM PROTECTION + UPI/PAYMENT PROTECTION + LINK/QR/MESSAGE SCANNING + DEVICE SECURITY + APP SECURITY + PRIVACY + FAMILY PROTECTION + AI SECURITY ADVISOR with a premium, modern and distinctive cybersecurity UI.

Comments (0)

No comments yet. Be the first!

Page 1 of 5

System Requirements Document for Cobalt-Ellu

Introduction

Cobalt-Ellu is an advanced Android cybersecurity application designed to provide comprehensive protection against scams, payment fraud, and device vulnerabilities. Built with Kotlin and Jetpack Compose, the application leverages AI to enhance security measures and ensure user safety. This document outlines the system requirements for Cobalt-Ellu, focusing on maintaining real functionality and a premium user interface.

System Overview

Cobalt-Ellu is a production-quality Android application that combines various cybersecurity features, including scam protection, UPI/payment protection, link/QR/message scanning, device security, app security, privacy management, family protection, and an AI security advisor. The application is designed to operate with real data and functionality, avoiding mock or demo data replacements.

Architecture

UI Layer: Built with Jetpack Compose, utilizing ViewModel for state management.
Domain Layer: Implements use cases and domain engines for business logic.
Data Layer: Utilizes Room, DataStore, Firebase, and Android APIs for data management.

Page 2 of 5

Tech Stack

Kotlin
Jetpack Compose
Hilt for dependency injection
Room for local database management
DataStore for preferences
Firebase Authentication and Firestore
WorkManager for background tasks
CameraX and ML Kit for scanning capabilities
Android PackageManager and system APIs for app and device management

Functional Requirements as Story Points

As a User, I should be able to authenticate using email/password, mobile/OTP, or continue without an account in Local Mode.
As a User, I should see a Security Score on the Home screen that reflects real device and app data.
As a User, I should be able to scan URLs, UPI payments, messages, and QR codes using the app's scanning features.
As a User, I should receive protection notifications and view device, app, privacy, and network security statuses.
As a User, I should manage permissions for Camera, POST_NOTIFICATIONS, and Notification Listener using real Android APIs.
As a User, I should view a history of scans and security events with filtering and deletion options.
As a User, I should receive real-time security reports with scores, scan counts, risks, and recommendations.
As a User, I should receive prioritized security recommendations from the Security Advisor based on real device/application state.
As a User, I should manage family protection features locally, including creating, joining, and leaving a family.
As a User, I should manage privacy settings, including clearing scan history and security events.
As a User, I should set, confirm, validate, change, and disable a PIN for app lock with secure hashing/storage.
As a User, I should navigate the app using main tabs: Home, Scan, Protection, Family, and History, with correct back behavior and state refresh.

Page 3 of 5

User Personas

Regular User: Individuals using the app for personal device security and privacy management.
Family Member: Users managing family protection features locally.
Security Enthusiast: Users interested in detailed security reports and recommendations.

Core User Flows

User logs in with email/password or mobile/OTP -> Views Security Score on Home -> Scans a QR code -> Receives scan results -> Navigates to Protection tab -> Manages device security settings.
User selects Family tab -> Creates a family group -> Invites members using an invite code -> Manages family protection settings locally.
User accesses Privacy settings -> Clears scan history -> Confirms deletion -> Views updated history count.

Visuals Colors and Theme

primary: #001F3F (deep navy)
primary_light: #003366 (lighter navy)
secondary: #50C878 (emerald green)
accent: #00FFFF (cyan)
highlight: #800080 (purple)
bg: #000000 (deep black)
surface: #1A1A1A (dark surface)
text: #FFFFFF (white)
text_muted: #B0B0B0 (light grey)
border: #333333 (subtle grey)

Page 4 of 5

Signature Design Concept

The Cobalt-Ellu app will feature a dynamic, interactive landing page with a "Security Galaxy" theme. Users will interact with a 3D galaxy map where each star represents a security feature. Clicking a star will open a detailed card about the feature, and dragging will rotate the galaxy to explore more features. The galaxy will have a glowing effect, with stars pulsing to indicate active features. This concept will use @react-three/fiber and @react-three/drei for 3D interactions.

Landing Hero Motion Brief

The landing hero will depict a transformation from a vulnerable device to a secure one. The animation will start with a device surrounded by threat icons, which are gradually neutralized by the app's security features, represented by glowing shields. The final frame will show a secure device with a high Security Score. This will be implemented using motion/react for smooth transitions and animations.

Interaction Model & Motion Direction

Intended Interaction Model: Animated
The landing page will feature moderate scroll-triggered reveals and hover transitions. Interactive elements will have spring physics for a polished feel. Internal pages will maintain a static layout for clarity.

Non-Functional Requirements

The app must maintain startup-performance optimizations and avoid blocking operations on the main thread.
Ensure all animations and transitions are smooth and do not fake security operations.

Page 5 of 5

Tech Stack

Frontend: Kotlin, Jetpack Compose
Backend: Firebase Authentication, Firestore
Database: Room, DataStore
AI Models: ML Kit for scanning capabilities
Local Orchestration: WorkManager

Assumptions and Constraints

The app will operate on Android devices with real data and functionality.
Unsupported Android capabilities will remain unavailable and not faked.

Glossary

Security Score: A metric indicating the security level of the device.
Local Mode: A mode where the app operates without cloud synchronization.
Permission Risk: The potential risk associated with app permissions.
Ellu Vectors: Custom vector graphics used for the app's illustration system.