Android × Security
Android Security
We track 25 Android Security case studies from 16 engineering teams. PickMe, Google and Guardsquare write about it most. Many posts also cover Android Internals and AI. The posts run from 2013 to 2026. The newest is from August 2026.
Android Security articles 1–25 of 25
Protect your Flutter iOS apps with Shorebird Obfuscation
Shorebird just launched obfuscation for Flutter iOS apps. If you're shipping sensitive code or worried about reverse engineering, this changes the game.
Stop Using FLAG_SECURE — Here's a Better Way to Protect Sensitive Screens in Jetpack Compose
Sanath Sajeeva Kumara from PickMe Engineering reveals why FLAG_SECURE is killing your Android app's UX. Banking apps block screenshots entirely—but there's a smarter way to hide sensitive data in Recent Apps wh...
Patch Me If You Can: AI Codemods for Secure-by-Default Android Apps
Pascal Hartig explores how Meta's Product Security team uses AI to automatically patch security vulnerabilities across millions of lines of Android code. The challenge? Doing this at scale without disrupting th...
The Second Beta of Android 17
Matthew McCullough just dropped Android 17 Beta 2, and it's packed with APIs that fundamentally change how apps handle privacy, cross-device experiences, and local network access. This isn't just another increm...
Breaking Down Mobile App Vulnerabilities
Jija Bhattacharya from Guardsquare breaks down recent mobile app vulnerabilities that exposed millions of users. These weren't sophisticated exploits—they were logic flaws and authorization failures hiding in p...
Why Your Mobile App Is Not as Secure as You Think
Pavithra Chamod J from PickMe Engineering drops a hard truth: your mobile app's security measures are probably theater. Once an APK hits a rooted device, all bets are off.
Your Development Environment Is a Security Risk: What Every Android Developer Needs to Know
Sanath Sajeeva Kumara from PickMe reveals a chilling truth: simply opening a project in Android Studio can steal your credentials before you click a single button. A 2026 incident proves your IDE might be your ...
How AI Is Transforming the Adoption of Secure-by-Default Mobile Frameworks
Meta just shared how they're using AI to automatically fix security vulnerabilities across billions of lines of code. The twist? The AI doesn't need to be perfect to be incredibly useful.
Enhancing Android Security: Stop Malware
Bennet Manuel and Rob Clifford from Google just dropped a security feature so simple it's almost embarrassing we didn't have it sooner: one line of code that blocks malware from reading your app's sensitive dat...
Elevating Android Security
Suzanne Frey from Google just announced a major shift in Android's security model. Starting 2026, every app installed on certified Android devices will need a verified developer behind it.
Securing API Keys and Sensitive Data in Android Apps: A Practical, Modern Guide
Numesh Dilusha from PickMe Engineering drops a hard truth: Android malware surged 40% in 2024/2025, and your hardcoded API keys are basically an open invitation. This comprehensive guide shows exactly how to lo...
Stop Storing Secrets Wrong: The Right Way to Encrypt Data in Android
Chamod Lakmal from PickMe reveals why most Android apps store secrets dangerously wrong. Hardcoded keys and SharedPreferences encryption are fundamentally broken, leaving user data vulnerable to extraction.
Cross-Platform Web3 dApps With React Native
Callstack explores how React Native is becoming the unexpected bridge between traditional mobile development and the Web3 ecosystem. Building decentralized apps just got a lot more practical.
Balancing Performance and Security with Android Baseline Profiles and DexGuard
Here's a performance optimization problem most Android teams don't see coming: your security tooling might be silently breaking your baseline profiles. Guardsquare just solved it.
Removing SMS support from Signal Android (soon)
Nina from Signal just announced they're killing a feature that's been in the Android app since before Signal even existed. After nearly a decade of supporting plaintext SMS alongside encrypted messages, they're...
Consent Matters
Swiggy's Android team faced a UX dilemma: auto-reading OTPs felt magical to some users, creepy to others. How do you balance convenience with transparency?
Giving Android a security boost (Part Two)
Zomato's Android team breaks down SSL certificate pinning: the security feature that could brick your app if done wrong.
Giving Android a security boost (Part One)
Zomato's Android team is tackling a critical vulnerability that most apps ignore. Your encrypted HTTPS traffic might not be as secure as you think.
8 Tips Learned from Adding Payments to DoorDash's Android App
DoorDash's Android team learned the hard way that adding payments isn't just about processing transactions. It's about building a system that scales across countries, payment methods, and user expectations.
Amplify Framework adds authentication features and enhancements for iOS and Android Mobile SDKs
AWS Amplify just made mobile authentication dramatically simpler. Device tracking, OAuth 2.0, and SAML federation now work out of the box for iOS and Android developers.
OkHttp 3.13 Requires Android 5+
Jesse Wilson explains why Square is cutting off 11% of Android devices with OkHttp 3.13. Spoiler: your web servers might break too.
AIR GO and APK Signing
Seunghoon Kim from LINE's AIR GO team breaks down Android's APK signing evolution. If you're still using v1 signing, you're leaving security holes wide open.
Universal Links for Android and iOS
Konstantin Yakushev from Bumble reveals the brutal truth about universal links: Apple and Google's 'simple' solution is riddled with undocumented bugs that break user experience. Here's how Badoo's team catalog...
Changes to SecretKeyFactory API in Android
Trevor Johns from Android Developer Relations reveals a breaking change that could silently corrupt encrypted data for apps using Unicode passphrases. If your app uses PBKDF2 key derivation, this affects you.
Login Verification On Twitter For iPhone And Android
Twitter built a 2FA system where your private keys never leave your phone and the server stores no persistent secrets. Here's the engineering behind it: