# v0.11 Universal SMS companion addition

- Added `android-universal/` Kotlin Android Studio source project.
- App can forward allowed sender-ID SMS events directly to the configured HTTPS `device-api.php` endpoint using a per-device Bearer secret.
- App requires explicit SMS permissions, offers enable/disable control, and avoids logging SMS contents or device secrets.
- Backend parser accepts `bKash` and `Mobile Banking` sender labels only when the body matches the existing strict bKash received-payment template.
- Safe default changed in `private/config.php.example`: `sms_auto_verify=false`.
- Existing PHP SMS parser tests pass; PHP syntax lint passes. Android build/runtime and live hosting were not tested because Android SDK/Gradle and server credentials are unavailable in this environment.


## v0.11.9 audit correction

- Android sender allowlist default now includes `bKash,NAGAD` instead of a generic `Mobile Banking` label that the strict parser cannot identify.
- UI text now accurately states that bKash/Nagad have specific receipt parsers; Rocket/Upay are not yet supported by this package.
- This correction does not claim provider API confirmation, live-hosting validation, or Rocket/Upay support. Test with genuine redacted receipt samples in staging before enabling any payment workflow.