I'm writing an Android app that deals with several external USB devices. Stakeholders have expressed security concerns around BroadcastReceivers because of SonarQube feedback, and it seems legitimate enough to pursue.
Is there a way to determine that a Broadcast (e.g. ACTION_USB_DEVICE_ATTACHED) came from the system itself, and not a third-party?
BroadcastReceivers can be restricted to receive Intents only from sources that have specific permissions granted. Is there a permission that only the system has that could be used to the desired effect?