Security

Android Security

Rule 1: Never store secrets in source code or BuildConfig

// ❌ Never — committed to git, visible in APK
const val API_KEY = "sk-1234567890abcdef"
buildConfigField("String", "API_KEY", "\"sk-1234567890abcdef\"")

// ✅ Use local.properties (gitignored) + build script injection
// local.properties (never commit this file)
// API_KEY=sk-1234567890abcdef

// build.gradle.kts
val apiKey = gradleLocalProperties(rootDir, providers).getProperty("API_KEY") ?: ""
buildConfigField("String", "API_KEY", "\"$apiKey\"")

// ✅ Better: use server-side proxy — never expose API keys in app at all
// Client → Your backend → Third-party API

Rule 2: Encrypted storage for sensitive data

// ✅ EncryptedSharedPreferences for tokens, session data
class SecureStorageImpl @Inject constructor(
    @ApplicationContext context: Context
) : SecureStorage {
    private val masterKey = MasterKey.Builder(context)
        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
        .build()

    private val encryptedPrefs = EncryptedSharedPreferences.create(
        context,
        "secure_prefs",
        masterKey,
        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
    )

    override fun saveToken(token: String) {
        encryptedPrefs.edit().putString("auth_token", token).apply()
    }

    override fun getToken(): String? = encryptedPrefs.getString("auth_token", null)

    override fun clearAll() = encryptedPrefs.edit().clear().apply()
}

Rule 3: Network Security Config

Rule 4: Certificate pinning

// ✅ OkHttp certificate pinning for high-security apps
val certificatePinner = CertificatePinner.Builder()
    .add("api.myapp.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")  // leaf
    .add("api.myapp.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=")  // backup
    .build()

OkHttpClient.Builder()
    .certificatePinner(certificatePinner)
    .build()

Rule 5: Prevent screenshots and screen recording

// ✅ Prevent screenshots on sensitive screens (banking, passwords)
@Composable
fun SecureScreen(content: @Composable () -> Unit) {
    val activity = LocalContext.current as? Activity
    DisposableEffect(Unit) {
        activity?.window?.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
        onDispose {
            activity?.window?.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
        }
    }
    content()
}

Rule 6: Backup rules — exclude sensitive files

Common Mistakes

❌ Storing tokens in plain SharedPreferences — use EncryptedSharedPreferences ❌ API keys in BuildConfig — visible by decompiling APK ❌ android:allowBackup="true" without backup rules — sensitive DB backed up to Google ❌ android:usesCleartextTraffic="true" in production — all traffic unencrypted ❌ Logging tokens or PII in debug — Log.d("token", userToken) visible in logcat ❌ No root detection for banking/payment apps — use Play Integrity API

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: piyushverma0
• Source: piyushverma0/android-agent-skills
• License: MIT
• Homepage: https://android-agent-skills.vercel.app

Install and usage instructions live in the source repository linked above.