As a noob user of KeePass2 on Windows desktop and Keypass2Android on my phone, supplemented by YubiKey Neo configured for hmac-sha1 challenge response, I noticed that Keepass2Android appears to store an xml file on Onedrive (at least it looks that way to me).
So I'd appreciate any shared insight on: 1. the nature/extent of risks arising from storing the encrypted kdbx database file along with the xml file (from Keepass2Android??) on Onedrive, and 2. any practical means for a regular user like me to mitigate those risks?
Background/context is that Keepass2 on my laptop is configured to sync the kdbx file (that's stored on my laptop) with an instance stored on Onedrive; and when not at my desktop, I use Keepass2Android on my phone to 'open-up' the sync'd kdbx file on Onedrive to check passwords etc. Thanks in advance.
P.S. As Onedrive doesn't appear to support Yubikey 2FA, I assume that c/b a relavent factor.