APKLint / Engineering notebook
Practical guides to Android packages, signing, security and release decisions. Start with the problem, inspect the evidence, and follow the relevant tool or official reference.
Showing 49–72 of 262 guides · Page 3 of 11.
Certificate pinning restricts which certificate public keys an Android client accepts for a server. It is not a substitute for TLS, hostname validation or.
android:usesCleartextTraffic="true" permits cleartext traffic in participating Android network components; it does not encrypt HTTP or make an insecure.
An Android Network Security Configuration defines app-specific trust and cleartext policies declaratively. A useful configuration is small enough to.
Checking an APK for malware is a risk assessment, not a single green badge. A clean result means the checks performed did not identify a problem at that.
A VirusTotal APK report aggregates security signals from multiple providers. Its detection count is a starting point for investigation, not a probability.
Static APK malware analysis examines a package without executing it. The goal of an initial triage is to produce testable observations: suspicious.
Android static analysis covers several different activities: checking source code, inspecting a compiled APK and reviewing dependency metadata. Choosing.
The most useful question when evaluating mobile security testing services is not “how many vulnerabilities will you find?” It is “what evidence will you.
An Android penetration test needs a written scope before anyone probes an app or its backend. The APK is only one part of the system: accounts, APIs, SDK.
A mobile app security checklist is useful only when each item has evidence and an owner. “Encryption enabled” is too vague to close a review; naming the.
The OWASP Mobile Application Security Testing Guide, or MASTG, is a testing resource—not a one-click compliance scanner. For an Android app, use it to turn.
The OWASP Mobile Top 10 is a risk-awareness resource. It helps teams discuss recurring classes of mobile security problems, but it is not a complete.
The OWASP Mobile Top 10 2016 remains useful for understanding older reports, but it should not be presented as the current checklist for a new Android.
MASVS, MASTG and the Mobile Top 10 answer different questions. MASVS helps define expected controls, MASTG helps test them, and the Mobile Top 10 helps.
An Android APK security review should establish what actually shipped, then identify which observations need runtime or backend testing. A source-code.
Reverse engineering an APK you own is most productive when it starts with a narrow question: which dependency shipped, why a resource is missing, or what.
Mobile app reverse engineering can reveal implementation details in a distributed client, but it cannot recover everything that produced that client..
“Decrypt APK file” often describes the wrong operation. A normal APK is a ZIP-based package containing compiled code and resources. Opening the archive,.
A string that looks like an API key is not automatically a confidential secret. The important questions are what the credential authorizes, whether it is.
An exported Android component is reachable from outside the app under the applicable platform rules. Exporting is sometimes necessary, but it should be a.
A secure Android WebView starts with a narrow trust model: which content may load, which origins may interact with native code, and which navigation leaves.
Android backup rules determine which app data can leave its normal on-device storage context through supported backup and transfer mechanisms. Excluding a.
An SDK or tracker audit needs more than a list of library names. Identify the versions that ship, the features enabled, the data actually collected and the.
Android “dangerous” permissions protect access to sensitive data or capabilities and can require a runtime grant. The label does not mean an app is.
Guides are dated references, not a live view of your app or Console. Verify changing policy and SDK details before release.
APKLint is independent and is not affiliated with Google, Android or the other projects discussed.