Remove debuggable behavior from release variants and verify the merged release manifest.

Disable cleartext globally or scope an unavoidable exception to the exact development host.

Define an explicit backup policy and exclude sensitive application data.

Expose a minimal interface to trusted content and validate every navigation.

Enable R8, keep rules focused, and exercise critical flows in a release-like build.