# ICTWorld Android Universal SMS — v0.11.9 audit correction

## Changes in this audit package
- Fixed Android app's default SMS sender allowlist: `bKash,NAGAD` replaces `bKash,Mobile Banking`. The generic label could not be identified by the strict provider parser, and the previous default excluded Nagad.
- Updated Android UI wording and documentation to state the actual scope: strict bKash and Nagad receipt templates only; Rocket and Upay remain unsupported until genuine, redacted SMS samples are supplied and parser tests are added.
- Added a regression test for the existing strict Nagad receipt template.

## Validation performed
- PHP syntax lint: 24 PHP files checked; no syntax errors.
- `tests/sms-parser-test.php`: passed, including amount-vs-balance, Dhaka-to-UTC conversion, invalid dates, OTP/sent-message rejection, strict Nagad template and payment-match mismatch cases.
- Archive structure was preserved and this is a source package, not a prebuilt Android APK.

## Important limits / deployment notes
- This package was not tested against a live merchant account, live cPanel/MySQL, or a real device; no server was changed.
- SMS parsing is not proof of provider-side settlement. Keep `sms_auto_verify=false` and use pending/manual review unless the business explicitly accepts SMS-only verification risk.
- Rocket and Upay are not implemented in this version. Do not select them or represent them as supported. Provider templates can vary; supply genuine samples with phone numbers, balances, names and other personal details redacted, while preserving message structure and field labels.
- Static Bangla QR cannot independently confirm payment. Use a unique reference/proof and pending/approved/rejected workflow; only reconcile SMS where an exact transaction can be matched.
- Keep `private/` outside the public document root, use HTTPS, protect device secrets and test on staging with a low-value transaction before production.