Docs: explain what on-device encryption is for and where it stops

[simonhamp]

Rewrites the second half of the mobile v4 security page.

The old text told developers they could "safely" encrypt data with Crypt and only mentioned the downside in a caution at the bottom. The new text leads with what on-device encryption is for and is direct about its limits.

What it now says:

• Laravel's encrypter works out of the box because each device gets its own APP_KEY in the Keychain or Keystore. No plugin is needed.
• The point is to stop someone who gets at the app's files or database from reading sensitive values. It suits short-lived tokens and anything that can be fetched again.
• The key never leaves the device, but the app's data is backed up and restored. Data whose only copy is encrypted on the device can be lost for good, so long-lived data belongs somewhere else.
• Apps should expect values they can no longer decrypt and handle DecryptException.
• Encrypted values should not be sent to a back-end or third party, since they cannot be decrypted without the key.
• Secure Storage is described as an alternative that keeps a value out of the database and files entirely. It is device-bound in the same way.

Things to check:

• The page says the Android key is stored in the Keystore. That is only true once Store the Android APP_KEY in the Keystore and stop bundling the developer's key mobile-air#519 is released, so this should not go live before then.
• The Secure Storage link now points at ../plugins/core/secure-storage. The old /docs/apis/secure-storage link looked stale.
• Only v4 is changed. I have not previewed the rendered page.

🤖 Generated with Claude Code