On this page
Security testing does not have to mean hiring a penetration firm. Most Android app vulnerabilities come from a short list of predictable places: how data sits on the device, how traffic travels, and what your components expose to other apps. This guide is a working checklist you can run against any release build, in order, with tools you already have installed.
Where Android apps get exposed
An Android app faces threats on three fronts. Data at rest lives in the app's private storage and databases, and any backup or misconfigured permission can leak it. Data in transit crosses whatever network the user is on, which may be hostile. And your components, activities, services, receivers, and providers, can be invoked by other apps unless you restrict them. A useful pass tests all three fronts.
The security checklist
- Data storage: no passwords, tokens, or personal data written in plain text to internal or external storage.
- Logging: debug logs stripped from release builds, because logcat output is readable by anyone with the device in hand during a debug session.
- Network traffic: every endpoint uses HTTPS, and cleartext traffic is disabled in your Network Security Config.
- Exported components: activities, services, receivers, and providers declare android:exported explicitly and require permissions where they should.
- Permissions: the app requests only what its features need, and every dangerous permission has an obvious user-facing reason.
- WebViews: JavaScript is enabled only for content you trust, and file access from URLs is disabled.
- Secrets: any API key shipped inside the APK should be treated as public, and server-side checks must not depend on it.
- Backups: allowBackup and fullBackupContent reviewed so sensitive data is not included in device backups.
- Dependencies: third-party libraries kept current, since vulnerabilities in them are inherited by your app.
- Release hardening: R8 minification and resource shrinking enabled on the build you actually upload.
How to run the pass
Audit the manifest first
Read AndroidManifest.xml end to end. Confirm every component that accepts external input declares its exported state and any protecting permission. The manifest takes ten minutes to read and is where the highest-impact issues hide.
Inspect traffic through a proxy
Run the app on an emulator or test device with a proxy such as mitmproxy or Charles installed with its certificate trusted. Click through every flow and confirm you see no plain HTTP requests and no sensitive payloads in logs or URLs.
Probe exported components
From adb, try invoking your exported activities and broadcasting to your receivers without permissions. Anything that performs a privileged action from an untrusted caller is a finding.
Audit storage and backups
On a rooted device or emulator, inspect the app's data directory and any databases. Check whether backups include them. Sensitive information should be encrypted at rest or kept out of storage entirely.
Repeat on the release build
R8 changes what is visible in the binary, and debug-only code paths disappear. Run the final security pass on the same signed release build you will upload to Play.
Running this list once gives you a baseline; repeating it on every release is what keeps the baseline true. AppsTestLab runs this kind of security pass as part of its Android App Testing service, alongside functional and regression coverage, so the checklist does not depend on someone on your team remembering to do it.
Frequently asked questions
Frequently asked questions
Is this checklist enough instead of a professional audit?
It covers the well-worn issues most apps ship with and is worth running before every release. A dedicated audit goes deeper with threat modeling and targeted exploitation, which suits apps handling payments, health, or identity data.
Do I need a rooted device?
No. The manifest audit, traffic inspection, and permission checks all work on standard hardware. Rooting or using an emulator only helps when you want to read the app's private storage directly.
Sources
Sources & references
Official Google documentationThese links open Google's official Play Console Help pages used to verify this guide. AppsTestLab guidance is independent and not affiliated with Google.
Get help doing this