Implement security practices for the app

[saifk16]

App Security Checklist

• Remove all hardcoded secrets from code
• Move dev keys to local.properties and add it to .gitignore
• Use CI to inject production secrets from a secrets manager (no repo secrets)
• Enable R8/ProGuard (minifyEnabled + shrinkResources) for release builds
• Harden ProGuard rules to obfuscate logic while keeping necessary models
• Use Play App Signing and keep your release .jks off the repo
• Keep signing keys secure (store in CI/secret manager)
• Store runtime secrets in Android Keystore / EncryptedSharedPreferences
• Encrypt local DB (use SQLCipher or equivalent)
• Use HTTPS only (block HTTP in network security config)
• Ensure TLS 1.2+ / TLS 1.3 on network clients
• Implement certificate pinning (OkHttp CertificatePinner)
• Use short-lived tokens (JWT/OAuth2) and rotate tokens regularly
• Move sensitive API calls / secrets handling to backend services
• Validate client signing certificate hash on the server for each client
• Bind session tokens to device identifiers or signatures on server side
• Implement rate limiting and throttling on APIs
• Verify app signature (SHA-256) at runtime in the app
• Check installer package (allow only known stores if appropriate)
• Integrate Play Integrity (or SafetyNet) with server-side attestation
• Detect rooted/jailbroken devices and respond appropriately
• Detect debugger attachment (Debug.isDebuggerConnected())
• Detect Frida/Xposed/Hooking frameworks and restrict functionality
• Perform APK checksum/hash integrity checks at runtime
• Move most-sensitive logic to native (NDK) where appropriate
• Clear sensitive data on logout and on uninstall if possible
• Prevent screenshots on sensitive screens (FLAG_SECURE)
• Run static analysis (MobSF) and dependency vulnerability scans regularly
• Run dynamic analysis and penetration tests (Burp/ZAP / external pentest)
• Automate secure, reproducible builds in CI/CD and monitor audit logs
• Keep dependencies updated and monitor for CVEs
• Respond to incidents: revoke/rotate keys, block compromised clients, and patch quickly