Inventory the final manifest
Review activities, services, receivers and providers in the built release. Record android:exported, intent filters, permissions and the feature that requires external access. Source manifests can be changed by libraries and build variants.
The platform security guidance explains why relying on historical defaults is fragile. Explicit declarations are easier to review across supported versions.
Classify each entry point
| Component purpose | Review direction |
|---|---|
| Launcher activity | External entry is normally intentional |
| Internal settings screen | Keep private unless a documented integration requires access |
| Partner-facing service | Authenticate or permission-protect the caller |
| Content provider | Review read/write permissions and URI-grant scope |
| Link-handling activity | Validate the route and enforce authorization after entry |
An exported activity that merely opens a public help screen is not equivalent to an exported action that changes account security settings.
Protect the operation, not just the screen
Validate incoming intents, extras, URIs and file references as untrusted input. Enforce authentication and authorization at the operation that reads or changes protected data. A previous screen having checked login does not protect a component that can be entered directly.
Do not accept a client-provided “isAdmin” extra as authority. Backend operations must enforce their own access checks regardless of how the Android screen was reached.
Test intended and unintended callers
Use a controlled test application or approved tooling to exercise the interface. Test missing extras, malformed values, unauthorized roles and valid authorized use. Record expected outcomes so tightening a manifest does not silently break a legitimate integration.
A signature-level permission may suit components shared between apps signed by the same trusted identity, but it is not a universal solution for unrelated partners.
Review with APKLint
The Exported Activity Checker can highlight declarations that deserve attention. It cannot determine every business authorization rule or prove that a runtime handler validates its input. Close findings with evidence from the actual release build and the component contract, not with a blanket “set everything false” change.
Sources and further reading
- Android Developers: android:exported
- Android Developers: App manifest overview
- Android Developers: Security best practices
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
