TL;DR: Android Security Checklist (15 Items)

1. Certificate Pinning to prevent man-in-the-middle attacks on API traffic.
2. Encrypt Local Storage with AES-256 using EncryptedSharedPreferences or SQLCipher.
3. ProGuard/R8 Obfuscation to make reverse engineering significantly harder.
4. Root Detection to block compromised devices from accessing sensitive features.
5. Secure API Communication with short-lived tokens, rate limiting, and payload signing.
6. Android Keystore for hardware-backed cryptographic key storage.
7. Biometric Authentication via BiometricPrompt API for sensitive operations.
8. Prevent Screenshots on screens displaying confidential data.
9. Input Validation on both client and server to block injection attacks.
10. HTTPS Everywhere with TLS 1.3 and no cleartext fallback.
11. Runtime Application Self-Protection (RASP) for real-time threat detection.
12. Secure WebView Configuration to prevent JavaScript injection and file access exploits.
13. Android 15 Granular Permissions for minimal data access.
14. Tamper Detection to verify APK signature integrity at runtime.
15. Automated Security Testing integrated into CI/CD pipelines.

Table of Contents

1. Why Android App Security Matters More Than Ever in 2026
2. The OWASP Mobile Top 10 (2026)
3. 15 Android Security Best Practices
4. Android Security Layers (Infographic)
5. Android Security Testing Tools Compared
6. Industry-Specific Security Requirements
7. When to Hire a Security Expert
8. Frequently Asked Questions

85% of Android apps contain at least one exploitable security vulnerability.

Source: NowSecure 2025 Mobile Security Report

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">api.yourapp.com</domain>
        <pin-set expiration="2027-01-01">
            <!-- Primary pin (current certificate) -->
            <pin digest="SHA-256">AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=</pin>
            <!-- Backup pin (next certificate rotation) -->
            <pin digest="SHA-256">BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=</pin>
        </pin-set>
    </domain-config>
</network-security-config>

val certificatePinner = CertificatePinner.Builder()
    .add("api.yourapp.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
    .add("api.yourapp.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=")
    .build()

val client = OkHttpClient.Builder()
    .certificatePinner(certificatePinner)
    .build()

// build.gradle
implementation "androidx.security:security-crypto:1.1.0-alpha06"

// Kotlin
val masterKey = MasterKey.Builder(context)
    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
    .build()

val encryptedPrefs = EncryptedSharedPreferences.create(
    context,
    "secure_prefs",
    masterKey,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)

// Use exactly like regular SharedPreferences
encryptedPrefs.edit()
    .putString("auth_token", token)
    .apply()

// build.gradle (app module)
android {
    buildTypes {
        release {
            minifyEnabled true
            shrinkResources true
            proguardFiles getDefaultProguardFile(
                'proguard-android-optimize.txt'
            ), 'proguard-rules.pro'
        }
    }
}

// proguard-rules.pro
# Keep security-critical classes from being obfuscated
-keep class com.yourapp.security.** { *; }

# Keep model classes used for API serialization
-keepclassmembers class com.yourapp.models.** {
    <fields>;
}

# Remove logging in release builds
-assumenosideeffects class android.util.Log {
    public static int d(...);
    public static int v(...);
    public static int i(...);
}

// Using Google Play Integrity API (recommended over SafetyNet)
val integrityManager = IntegrityManagerFactory.create(context)

val integrityTokenRequest = IntegrityTokenRequest.builder()
    .setNonce(generateNonce())
    .build()

integrityManager.requestIntegrityToken(integrityTokenRequest)
    .addOnSuccessListener { response ->
        // Send token to your server for verification
        verifyIntegrityOnServer(response.token())
    }
    .addOnFailureListener { e ->
        // Handle failure - consider blocking sensitive ops
        restrictSensitiveFeatures()
    }

// Server-side: decode and check deviceIntegrity
// MEETS_DEVICE_INTEGRITY = not rooted, passes CTS
// MEETS_BASIC_INTEGRITY = may be rooted but not actively attacked
// No label = device is compromised

// OkHttp Interceptor for request signing
class ApiSecurityInterceptor(
    private val keyStore: KeyStoreManager
) : Interceptor {

    override fun intercept(chain: Interceptor.Chain): Response {
        val original = chain.request()
        val timestamp = System.currentTimeMillis().toString()
        val nonce = UUID.randomUUID().toString()

        // Create HMAC signature of request body + timestamp + nonce
        val bodyBytes = original.body?.let { body ->
            val buffer = Buffer()
            body.writeTo(buffer)
            buffer.readByteArray()
        } ?: ByteArray(0)

        val signaturePayload = "${original.url}|$timestamp|$nonce|${
            bodyBytes.toBase64()
        }"
        val signature = keyStore.signWithHmac(signaturePayload)

        val secured = original.newBuilder()
            .header("X-Timestamp", timestamp)
            .header("X-Nonce", nonce)
            .header("X-Signature", signature)
            .header("Authorization", "Bearer ${getShortLivedToken()}")
            .build()

        return chain.proceed(secured)
    }
}

// Generate a key pair in Android Keystore
val keyPairGenerator = KeyPairGenerator.getInstance(
    KeyProperties.KEY_ALGORITHM_EC,
    "AndroidKeyStore"
)

val parameterSpec = KeyGenParameterSpec.Builder(
    "my_secure_key",
    KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY
).apply {
    setDigests(KeyProperties.DIGEST_SHA256)
    setUserAuthenticationRequired(true)
    setUserAuthenticationParameters(
        300, // timeout in seconds
        KeyProperties.AUTH_BIOMETRIC_STRONG
    )
    // Use StrongBox if available (dedicated security chip)
    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
        setIsStrongBoxBacked(true)
    }
}.build()

keyPairGenerator.initialize(parameterSpec)
val keyPair = keyPairGenerator.generateKeyPair()

// Sign data with the Keystore key
val signature = Signature.getInstance("SHA256withECDSA")
signature.initSign(keyPair.private)
signature.update(dataToSign)
val signedBytes = signature.sign()

// Secure biometric auth with CryptoObject binding
val biometricPrompt = BiometricPrompt(
    this, // FragmentActivity
    executor,
    object : BiometricPrompt.AuthenticationCallback() {

        override fun onAuthenticationSucceeded(
            result: BiometricPrompt.AuthenticationResult
        ) {
            // The cipher is now unlocked - use it to decrypt
            val cipher = result.cryptoObject?.cipher
            cipher?.let {
                val decryptedData = it.doFinal(encryptedPayload)
                processSecureData(decryptedData)
            }
        }

        override fun onAuthenticationError(
            errorCode: Int, errString: CharSequence
        ) {
            // Handle error - do NOT fall back to weak auth
            showAuthenticationError(errString)
        }
    }
)

// Create a CryptoObject tied to a Keystore key
val cipher = getCipherFromKeystore("biometric_key")
val cryptoObject = BiometricPrompt.CryptoObject(cipher)

val promptInfo = BiometricPrompt.PromptInfo.Builder()
    .setTitle("Authenticate")
    .setSubtitle("Verify your identity to continue")
    .setAllowedAuthenticators(BiometricManager.Authenticators.BIOMETRIC_STRONG)
    .setNegativeButtonText("Cancel")
    .build()

biometricPrompt.authenticate(promptInfo, cryptoObject)

// In your Activity's onCreate
override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)

    // FLAG_SECURE prevents screenshots and screen recording
    window.setFlags(
        WindowManager.LayoutParams.FLAG_SECURE,
        WindowManager.LayoutParams.FLAG_SECURE
    )

    setContentView(R.layout.activity_sensitive_data)
}

// For Jetpack Compose, set it at the composable level
@Composable
fun SecureScreen() {
    val context = LocalContext.current

    DisposableEffect(Unit) {
        val window = (context as Activity).window
        window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)

        onDispose {
            window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
        }
    }

    // Your sensitive UI content here
}

// Input validation utility
object InputValidator {

    // Sanitize and validate Intent extras
    fun sanitizeIntentData(intent: Intent): Map<String, Any>? {
        return try {
            val data = mutableMapOf<String, Any>()
            intent.extras?.keySet()?.forEach { key ->
                val value = intent.extras?.getString(key)
                if (value != null && isCleanInput(value)) {
                    data[key] = value.take(MAX_INPUT_LENGTH)
                }
            }
            data.ifEmpty { null }
        } catch (e: Exception) {
            null // Reject malformed intents entirely
        }
    }

    // Validate deep link URIs
    fun validateDeepLink(uri: Uri): Boolean {
        val allowedHosts = setOf("yourapp.com", "www.yourapp.com")
        val allowedSchemes = setOf("https", "yourapp")

        return uri.scheme in allowedSchemes
            && uri.host in allowedHosts
            && !uri.path.orEmpty().contains("..")
            && uri.queryParameterNames.all { isCleanInput(it) }
    }

    private fun isCleanInput(input: String): Boolean {
        // Reject SQL injection, XSS, and path traversal
        val dangerousPatterns = listOf(
            "('|\"|;|--)", // SQL injection
            "(<script|javascript:)", // XSS
            "(\\.\\.[\\\\/])", // Path traversal
        )
        return dangerousPatterns.none { pattern ->
            Regex(pattern, RegexOption.IGNORE_CASE).containsMatchIn(input)
        }
    }

    private const val MAX_INPUT_LENGTH = 1000
}

<!-- AndroidManifest.xml -->
<application
    android:networkSecurityConfig="@xml/network_security_config"
    android:usesCleartextTraffic="false">

<!-- res/xml/network_security_config.xml -->
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- Block all cleartext traffic globally -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>

    <!-- Debug overrides for local development -->
    <debug-overrides>
        <trust-anchors>
            <certificates src="user" />
        </trust-anchors>
    </debug-overrides>
</network-security-config>

// Basic RASP checks (for production, use a commercial SDK)
object RuntimeProtection {

    fun performSecurityChecks(context: Context): SecurityStatus {
        val threats = mutableListOf<String>()

        if (isDebuggerAttached()) threats.add("debugger")
        if (isFridaDetected()) threats.add("frida")
        if (isRunningOnEmulator()) threats.add("emulator")
        if (isAppTampered(context)) threats.add("tampered")

        return SecurityStatus(threats)
    }

    private fun isDebuggerAttached(): Boolean {
        return Debug.isDebuggerConnected()
            || Debug.waitingForDebugger()
    }

    private fun isFridaDetected(): Boolean {
        // Check for Frida's default listening port
        return try {
            val socket = java.net.Socket()
            socket.connect(
                java.net.InetSocketAddress("127.0.0.1", 27042), 100
            )
            socket.close()
            true // Frida is likely running
        } catch (e: Exception) {
            false
        }
    }

    private fun isRunningOnEmulator(): Boolean {
        return (Build.FINGERPRINT.startsWith("generic")
            || Build.FINGERPRINT.startsWith("unknown")
            || Build.MODEL.contains("Emulator")
            || Build.MANUFACTURER.contains("Genymotion")
            || Build.BRAND.startsWith("generic")
            || Build.PRODUCT.startsWith("sdk"))
    }

    private fun isAppTampered(context: Context): Boolean {
        val validSignature = "YOUR_RELEASE_SIGNATURE_HASH"
        val currentSignature = getAppSignature(context)
        return currentSignature != validSignature
    }
}

// Secure WebView configuration
val webView = WebView(context).apply {
    settings.apply {
        // Disable file access entirely
        allowFileAccess = false
        allowFileAccessFromFileURLs = false
        allowUniversalAccessFromFileURLs = false
        allowContentAccess = false

        // Enable JavaScript only if you need it
        javaScriptEnabled = true // set to false if not needed

        // Disable potentially dangerous features
        setSupportZoom(false)
        saveFormData = false
        databaseEnabled = false
        domStorageEnabled = true // only if needed

        // Force HTTPS
        mixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW
    }

    // Restrict navigation to allowed domains
    webViewClient = object : WebViewClient() {
        override fun shouldOverrideUrlLoading(
            view: WebView, request: WebResourceRequest
        ): Boolean {
            val allowedHosts = setOf(
                "yourapp.com", "api.yourapp.com"
            )
            return if (request.url.host !in allowedHosts) {
                true // Block navigation to unknown domains
            } else {
                false // Allow
            }
        }
    }
}

// NEVER do this in production:
// webView.addJavascriptInterface(obj, "Android")
// unless you absolutely need it and have validated all inputs

// Modern permission handling with Activity Result API
class SecureActivity : AppCompatActivity() {

    // Use Photo Picker instead of READ_EXTERNAL_STORAGE
    private val pickMedia = registerForActivityResult(
        ActivityResultContracts.PickVisualMedia()
    ) { uri ->
        uri?.let { processSelectedImage(it) }
    }

    // Request permissions with proper rationale
    private val requestPermission = registerForActivityResult(
        ActivityResultContracts.RequestPermission()
    ) { isGranted ->
        if (isGranted) {
            enableFeature()
        } else {
            showFeatureDegradedUI()
        }
    }

    fun selectProfilePhoto() {
        // No permission needed - Photo Picker handles it
        pickMedia.launch(
            PickVisualMediaRequest(
                ActivityResultContracts.PickVisualMedia.ImageOnly
            )
        )
    }

    fun requestLocationForDelivery() {
        when {
            ContextCompat.checkSelfPermission(
                this, Manifest.permission.ACCESS_FINE_LOCATION
            ) == PackageManager.PERMISSION_GRANTED -> {
                enableFeature()
            }
            shouldShowRequestPermissionRationale(
                Manifest.permission.ACCESS_FINE_LOCATION
            ) -> {
                showLocationRationaleDialog {
                    requestPermission.launch(
                        Manifest.permission.ACCESS_FINE_LOCATION
                    )
                }
            }
            else -> {
                requestPermission.launch(
                    Manifest.permission.ACCESS_FINE_LOCATION
                )
            }
        }
    }
}

object TamperDetection {

    // Verify APK signature matches expected value
    fun verifySignature(context: Context): Boolean {
        return try {
            val packageInfo = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
                context.packageManager.getPackageInfo(
                    context.packageName,
                    PackageManager.GET_SIGNING_CERTIFICATES
                )
            } else {
                @Suppress("DEPRECATION")
                context.packageManager.getPackageInfo(
                    context.packageName,
                    PackageManager.GET_SIGNATURES
                )
            }

            val signatures = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
                packageInfo.signingInfo.apkContentsSigners
            } else {
                @Suppress("DEPRECATION")
                packageInfo.signatures
            }

            val currentHash = signatures.firstOrNull()?.let { sig ->
                val md = MessageDigest.getInstance("SHA-256")
                md.digest(sig.toByteArray())
                    .joinToString("") { "%02x".format(it) }
            }

            currentHash == EXPECTED_SIGNATURE_HASH
        } catch (e: Exception) {
            false
        }
    }

    // Verify installation source
    fun isInstalledFromPlayStore(context: Context): Boolean {
        val installer = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
            context.packageManager
                .getInstallSourceInfo(context.packageName)
                .installingPackageName
        } else {
            @Suppress("DEPRECATION")
            context.packageManager
                .getInstallerPackageName(context.packageName)
        }
        return installer == "com.android.vending"
    }

    private const val EXPECTED_SIGNATURE_HASH = "your_sha256_hash_here"
}

# .github/workflows/security-scan.yml
name: Android Security Scan

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Dependency vulnerability scan
      - name: Dependency Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: 'android-app'
          path: '.'
          format: 'HTML'

      # Static analysis with MobSF
      - name: Build Debug APK
        run: ./gradlew assembleDebug

      - name: MobSF Static Analysis
        run: |
          docker run --rm \
            -v "$PWD/app/build/outputs/apk/debug:/input" \
            opensecurity/mobile-security-framework-mobsf \
            mobsf --scan /input/app-debug.apk \
            --output /input/report.json

      # Lint security rules
      - name: Android Lint Security Check
        run: ./gradlew lint
        # Ensure lintOptions in build.gradle has:
        # warningsAsErrors true
        # checkDependencies true

      # Secrets detection
      - name: Scan for Hardcoded Secrets
        uses: trufflesecurity/trufflehog@main
        with:
          path: .
          extra_args: --only-verified

Teams that integrate security scanning into CI/CD catch 73% of vulnerabilities before code reaches production.

Source: Synopsys 2025 Software Security Report

Need a Security Audit for Your Android App?

Our engineers have built HIPAA-compliant and PCI-DSS-compliant mobile apps. From security assessment to remediation.

Get a Security Assessment

What is the most critical Android security measure for a new app?

Encrypted local storage and HTTPS enforcement. These two measures protect user data at rest and in transit, which covers the two most common attack vectors. Start with EncryptedSharedPreferences from Jetpack Security for stored data and a Network Security Config that blocks all cleartext traffic. Once those are in place, add certificate pinning and then work through the remaining 13 practices based on your app’s risk profile. Apps handling sensitive data (health, financial, authentication) should prioritize Android Keystore integration and biometric authentication as their next steps.

Is certificate pinning still necessary in 2026?

Yes, and arguably more necessary than ever. Certificate Transparency (CT) logs have made certificate misissuance more detectable, but they have not eliminated man-in-the-middle attacks. Corporate proxy environments, compromised CA certificates, and state-level attackers can all intercept TLS traffic without triggering CT alerts. Certificate pinning is the only defense that verifies you are actually talking to your server and not a proxy presenting a valid but wrong certificate. The implementation has gotten easier with Android’s Network Security Config, and the operational burden has decreased now that most teams use public key pinning with backup pins and expiration dates.

How do I test my app against the OWASP Mobile Top 10?

Start with MobSF (Mobile Security Framework), which is free, open-source, and runs in Docker. Upload your APK and it will scan for issues mapped to the OWASP Mobile Top 10 categories automatically. For more thorough testing, combine MobSF with manual testing using Burp Suite (for API traffic inspection) and Frida (for runtime behavior analysis). The OWASP MASTG (Mobile Application Security Testing Guide) provides step-by-step testing procedures for each risk category. For a comprehensive assessment, run Drozer to enumerate and test your app’s IPC attack surface, especially if you have exported ContentProviders or custom URL schemes.

What is the difference between Android Keystore and EncryptedSharedPreferences?

Android Keystore is a low-level system for generating and storing cryptographic keys in hardware-backed secure storage (TEE or StrongBox). The keys never leave the secure hardware, and you use them to perform cryptographic operations like signing or encryption. EncryptedSharedPreferences is a higher-level library that uses Android Keystore internally to encrypt key-value data stored in SharedPreferences files. Think of Keystore as the vault where your keys live, and EncryptedSharedPreferences as a convenient tool built on top of that vault. For most apps, EncryptedSharedPreferences is the right choice for storing configuration data and tokens. Use Keystore directly when you need custom cryptographic operations, biometric-bound keys, or hardware attestation.

Does ProGuard/R8 obfuscation actually stop attackers?

It raises the bar significantly but does not stop a determined attacker. R8 obfuscation makes reverse engineering slower and more expensive by renaming classes and methods to meaningless characters, removing unused code, and optimizing bytecode. A skilled reverse engineer using jadx or JEB can still understand the logic, but it takes hours or days instead of minutes. The real value of R8 is that it stops casual attackers and automated scanning tools from quickly finding hardcoded secrets, API endpoints, and security logic. For higher assurance, combine R8 with commercial obfuscation tools like DexGuard or ProGuard’s successor, which add string encryption, control flow obfuscation, and native library protection.

How do I handle security on devices running old Android versions?

Android fragmentation is a real challenge for security. Devices running Android 8 or 9 do not have the same Keystore capabilities, permission models, or network security defaults as Android 14 and 15. The practical approach is to set a minimum SDK version that supports your required security features (API 26/Android 8.0 is a reasonable floor in 2026), use Jetpack Security libraries that provide backward-compatible implementations, and degrade gracefully on older devices. For apps handling highly sensitive data, consider blocking devices below a certain OS version entirely. Google’s own data shows that over 85% of active Android devices now run Android 10 or later, so raising the minimum version is less painful than it used to be. The alternative is maintaining parallel security implementations, which doubles your testing surface and increases the chance of bugs.

Ship Secure Mobile Apps, Faster

Vetted Android engineers with security expertise. OWASP-aligned. HIPAA and PCI-DSS experience.

Hire Android Engineers

8,200+ vetted engineers. 14 verified Clutch reviews. Backed by Harvard and Stanford alumni.