Security & Reverse Engineering
Certificate Pinning on Android: Benefits, Failure Modes and Rotation
Certificate pinning restricts which certificate public keys an Android client accepts for a server.
4 min read
APKLint / Engineering notebook
Android engineering guides.
Page 3 of 11.
Practical guides to Android packages, signing, security and release decisions. Start with the problem, inspect the evidence, and follow the relevant tool or official reference.
262 focused guides61 free toolsReference review: 22 Sep 2026
Showing 49–72 of 262 guides · Page 3 of 11.
Security & Reverse Engineering
usesCleartextTraffic=true: Scope the Exception, Do Not Disable Security Globally
Understand Android cleartext-traffic settings, prefer HTTPS and keep any necessary HTTP exception narrow and explicitly documented.
3 min read
Security & Reverse Engineering
Android Network Security Config with Narrow Trust Rules
An Android Network Security Configuration defines app-specific trust and cleartext policies declaratively.
4 min read
Security & Reverse Engineering
Check an APK for Malware Without Trusting Zero Detections
Checking an APK for malware is a risk assessment, not a single green badge. A clean result means the checks performed did not identify a problem at that time.
4 min read
Security & Reverse Engineering
VirusTotal APK Checks: Read Detections and Protect Confidential Builds
A VirusTotal APK report aggregates security signals from multiple providers.
4 min read
Security & Reverse Engineering
APK Malware Analysis: A Static Triage Worksheet
Static APK malware analysis examines a package without executing it.
3 min read
Security & Reverse Engineering
Android Static Analysis: What the Binary Can Tell You
Android static analysis covers several different activities: checking source code, inspecting a compiled APK and reviewing dependency metadata.
4 min read
Security & Reverse Engineering
Evaluate Mobile Security Testing Services with Real Scope
Evaluate mobile security testing services by scope, methods and evidence, including the actual app, backend and release process.
4 min read
Security & Reverse Engineering
Scope an Android Penetration Test Before Testing
An Android penetration test needs a written scope before anyone probes an app or its backend.
4 min read
Security & Reverse Engineering
Mobile App Security Checklist: Evidence for Each Control
Build a mobile app security checklist with evidence, owners and concrete tests for storage, authentication, networking and release behavior.
4 min read
Security & Reverse Engineering
Use the OWASP MASTG for an Android Test Plan
The OWASP Mobile Application Security Testing Guide, or MASTG, is a testing resource—not a one-click compliance scanner.
4 min read
Security & Reverse Engineering
OWASP Mobile Top 10: Turn Categories into Android Checks
The OWASP Mobile Top 10 is a risk-awareness resource.
4 min read
Security & Reverse Engineering
OWASP Mobile Top 10 2016: Historical Mapping, Not Current Guidance
The OWASP Mobile Top 10 2016 remains useful for understanding older reports, but it should not be presented as the current checklist for a new Android release.
3 min read
Security & Reverse Engineering
MASVS vs MASTG vs Mobile Top 10: Pick the Right Resource
MASVS, MASTG and the Mobile Top 10 answer different questions.
3 min read
Security & Reverse Engineering
Android APK Security Review: From Flags to Runtime Evidence
An Android APK security review should establish what actually shipped, then identify which observations need runtime or backend testing.
4 min read
Security & Reverse Engineering
Reverse Engineer an APK You Own: A Repeatable Notebook
Investigate an APK you own with a focused question, preserved artifacts and reproducible notes about code, resources and release changes.
3 min read
Security & Reverse Engineering
Mobile App Reverse Engineering: Authorization, Evidence and Limits
Mobile app reverse engineering can reveal implementation details in a distributed client, but it cannot recover everything that produced that client.
4 min read
Security & Reverse Engineering
“Decrypt APK File” Usually Means Decode: Identify the Actual Format
“Decrypt APK file” often describes the wrong operation. A normal APK is a ZIP-based package containing compiled code and resources.
3 min read
Security & Reverse Engineering
Hardcoded API Keys in APKs: Separate Public Identifiers from Secrets
A string that looks like an API key is not automatically a confidential secret.
3 min read
Security & Reverse Engineering
Audit Exported Android Components Without Breaking Them
An exported Android component is reachable from outside the app under the applicable platform rules.
3 min read
Security & Reverse Engineering
Android WebView Security: Validate Origins, URLs and JavaScript Bridges
Review Android WebView navigation, JavaScript bridges, file access and trust boundaries using the actual content your app loads.
3 min read
Security & Reverse Engineering
Android Backup Rules: Keep Sensitive Data Out of Backups
Android backup rules determine which app data can leave its normal on-device storage context through supported backup and transfer mechanisms.
3 min read
Security & Reverse Engineering
Audit Third-Party SDKs and Trackers Beyond Name Detection
An SDK or tracker audit needs more than a list of library names.
4 min read
Manifest & Permissions
Android Dangerous Permissions: A Version-Aware Inventory
Android “dangerous” permissions protect access to sensitive data or capabilities and can require a runtime grant. The label does not mean an app is malicious.
3 min read
Guides are dated references, not a live view of your app or Console. Verify changing policy and SDK details before release.
APKLint is independent and is not affiliated with Google, Android or the other projects discussed.