Debuggable Release Build

Description

Shipping with android:debuggable="true" or similar debug flags allows runtime inspection, file access via run-as, and easier hooking, making reverse engineering and tampering trivial.

Examples

Check Debuggable Flag

aapt dump badging app-release.apk | rg -i debuggable
# Or
apkanalyzer manifest print app-release.apk | rg -i debuggable

If debuggable is true in release, the app is exposed.

Remediation

1. Build types and CI gates
   • Ensure release builds set debuggable=false; add CI checks to fail on debug artifacts.
2. Remove debug helpers
   • Strip logging, WebView debugging, and developer menus from production.
3. Defense in depth
   • Combine with obfuscation and integrity checks to slow reverse engineering.