01
Release configuration
Confirm the release variant is not debuggable, is built from the intended signing configuration, and has release-only behavior exercised in testing.
Pre-release review
Android release security checklist
Use this before producing a production artifact. It focuses on configuration and source-level risks that can be reviewed without uploading an app or source tree.
A checked item is a review decision, not proof of security. Test the release build and get specialist review for high-impact applications.
02
Network policy
Disable cleartext traffic unless a documented exception is unavoidable. Restrict any exception to the exact host and environment that requires it.
03
Backup policy
Set backup behavior intentionally. Exclude tokens, identifiers, and sensitive local data from every supported backup and transfer path.
04
WebView boundary
Keep JavaScript bridges minimal, load only trusted content, validate navigation, and disable file access unless a tightly constrained use case requires it.
05
Secrets and signing
Search the repository and build files for credentials and signing passwords. Move secrets to a managed CI secret store or untracked local configuration, then rotate exposed values.
06
R8 and release behavior
Enable shrinking for the release artifact where appropriate. Exercise critical flows on a minified build and keep rules focused on the behavior that needs them.
07
Logs and release debt
Make logging release-aware, ensure sensitive values never reach logs, and resolve or explicitly accept release-relevant TODO and FIXME markers.
Local check
Start with a reproducible scan.
ShipSentry Lite checks these common patterns locally and writes a Markdown report with file-level evidence.