ProGuard/R8 & Secure Coding

Copy code// build.gradle.kts
android {
    buildTypes {
        release {
            isMinifyEnabled = true          // enable R8 shrinking/obfuscation
            isShrinkResources = true        // also shrink unused resources
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
                "proguard-rules.pro"
            )
        }
    }
}

Copy code# Keep data classes used with Gson/Kotlin Serialization (reflection-based)
-keep class com.example.data.** { *; }

# Keep enum classes (R8 can break them)
-keepclassmembers enum * {
    public static **[] values();
    public static ** valueOf(java.lang.String);
}

# Keep Parcelable implementations
-keepclassmembers class * implements android.os.Parcelable {
    public static final android.os.Parcelable$Creator CREATOR;
}

# Keep custom exceptions
-keep public class * extends java.lang.Exception

# Keep classes annotated with @Keep
-keep @androidx.annotation.Keep class * { *; }
-keepclassmembers class * {
    @androidx.annotation.Keep *;
}

Copy code@Keep  // R8 won't rename or remove this class
data class ApiResponse(
    val id: String,
    val title: String,
    val body: String
)

class MyReflection {
    @Keep  // R8 won't rename this method
    fun callFromNativeCode() { ... }
}

Copy code# De-obfuscate a stack trace
java -jar retrace.jar \
  app/build/outputs/mapping/release/mapping.txt \
  obfuscated-stacktrace.txt

Copy code// build.gradle.kts — upload mapping file automatically
plugins {
    id("com.google.firebase.crashlytics")
}
// Crashlytics uploads mapping.txt during release build

Copy code// ❌ Secrets in source code — visible in APK even with obfuscation
const val API_KEY = "sk-live-abc123xyz"  // extractable from APK via strings command

// ✅ Fetch from server; store in encrypted prefs
class SecretManager(private val api: SecretsApi) {
    suspend fun getApiKey(): String = api.fetchApiKey(deviceToken)
}

// ✅ Or use BuildConfig for non-sensitive config, stored in server-side
// build.gradle.kts — for non-secret values
buildConfigField("String", "API_BASE_URL", "\"https://api.example.com\"")

Copy code// Validate all user input at system boundaries
fun parseUserId(input: String): String? {
    // Allow only alphanumeric + hyphens, max 36 chars (UUID format)
    val regex = Regex("^[a-zA-Z0-9\\-]{1,36}$")
    return if (regex.matches(input)) input else null
}

// SQL injection: Room prevents this with parameterized queries — use @Query, not raw execSQL
@Query("SELECT * FROM articles WHERE id = :id")  // parameterized — safe
suspend fun getById(id: String): ArticleEntity?

// ❌ Never build SQL by concatenation:
// db.execSQL("SELECT * FROM articles WHERE id = '$id'")  // SQL injection!

Copy code// ❌ Logging sensitive data — visible in adb logcat and device logs
Log.d("Auth", "Token: $authToken")
Log.d("User", "Email: $userEmail")

// ✅ Use Timber with a tree that strips sensitive logs in release
class ReleaseTree : Timber.Tree() {
    override fun log(priority: Int, tag: String?, message: String, t: Throwable?) {
        if (priority < Log.WARN) return  // only log warnings and errors in release
        // Send to Crashlytics or similar — no PII
    }
}

// In Application.onCreate:
if (BuildConfig.DEBUG) {
    Timber.plant(Timber.DebugTree())
} else {
    Timber.plant(ReleaseTree())
}