Veto — Resilient Android Remote Management

What this project is

Veto is designed to let an owner locate, secure and recover an Android device through several independent command paths. The public implementation includes an Android client and a Next.js web dashboard, with Firebase messaging, SMS and notification-reply transports, plus an in-app test path.

Why Neubofy publishes it

Veto is a strong Neubofy capability demonstration because it forces engineering decisions across mobile security, cryptography, transport redundancy, hardware controls, permissions, cloud integration and failure conditions. It also shows the kind of defensive engineering and verification mindset that supports Neubofy’s broader technology-assurance positioning.

What the system demonstrates

Multiple control transports

Web dashboard via Firebase FCM, native SMS fallback, notification auto-reply and an in-app test sandbox.

Remote device commands

Locate, ring, lock, camera/media capture, flashlight, telemetry and device-control actions.

Theft macro

A coordinated emergency workflow that can activate location, Bluetooth, siren/alert behavior and evidence capture.

Security layer

AES-GCM command protection, PBKDF2/SHA-256 derivation, allowlisting and permission-gated execution.

User-controlled storage

Media is described as going to the user’s linked Google Drive rather than a proprietary media store.

Self-hosting orientation

The project documents a Vercel + Firebase deployment path for users who want greater infrastructure control.

Architecture & engineering evidence

The architecture separates command origin, transport, command validation, execution workers and device capabilities. The Android manifest itself shows the system is deliberately interacting with high-impact capabilities such as SMS, location, camera, microphone, notifications, device administration and secure settings.

Android/Kotlin + Jetpack Compose • Next.js/TypeScript web dashboard • Firebase Auth/FCM/Firestore • WorkManager • Google Drive • AES-GCM • PBKDF2-HMAC-SHA256 • native Android permissions/services

What this says about Neubofy

Failure-mode thinking: the design assumes one communication path can disappear.
Security is implemented as a system of controls, not as a marketing layer.
Mobile, web and cloud components are designed to cooperate under constrained conditions.
The project demonstrates comfort with sensitive permissions and explicit trust boundaries.

Positioning note

Because Veto can control device hardware and capture sensitive media, its security and privacy behavior should be evaluated from the actual source, permissions and deployment configuration—not inferred from the feature list alone. Some behaviors also depend on Android version and granted permissions.