I’ve installed a custom ROM on my Android phone from an untrusted internet source. My main purpose was to test APK applications that I develop myself.

However, I have serious security concerns:

1. Is it possible for the ROM creator to modify the source code to steal information?

2. Specifically, could they access:

   • My APK applications?
   • Files and images in the /sdcard directory?

3. If possible, can they do this without requesting Android permissions?

4. Is there any way to check if the ROM contains malicious code?

5. Are there any preventive measures to protect data when using a custom ROM from an untrusted source?

6. How significant is the risk of data theft or other security breaches in this scenario?

Thank you for your insights on this potentially dangerous situation.