The practical security checklist I run on every Android app I touch — from the Play Data Safety form to encrypted storage, with the code and the failure modes.
Last year I was asked to review the security posture of an existing Android app before a funding round. The app had 300,000 installs and stored users' payment tokenization references, addresses, and order history. The audit took me a weekend and it was not encouraging.
The app had three problems that together would have made any competent attacker smile: it sent API calls over plain HTTP in two places, it stored a refresh token in plain SharedPreferences, and it logged the full request body — including a bearer token — to Logcat in debug builds that had been shipped to production with minifyEnabled off. None of these were exotic zero-days. They were everyday mistakes. And the Play Data Safety form the team had filed claimed the opposite of what the code did.
Here is the thing about Android security: it is not one big feature you bolt on at the end. It is a set of small, boring, repeatable decisions made in every screen you touch. This article is the exact checklist I walk through — in the order I walk through it — with the code that actually works and the pitfalls that make each layer fail.
