Android open source password manager

I built a small offline Android password generator for personal use.
What does this app have?
Kotin 100%

1. No network, no storage, no analytics.
2. Prevent screen shoot taking, clear clipboard after 60 second
3. Non- ACSII support more than 100 languages I’m trying to get better at threat modeling and security review. For projects like this, what are the common Android security pitfalls you usually look for?

Entropy assumptions?
Clipboard handling?
Memory exposure?

https://github.com/quanaoqua5-eng/Open-source-password-generator

Would love to hear how experienced Android devs approach this.