android-securitylisted

# Android App Security Android gives you app sandboxing, SELinux, and a hardware-backed Keystore for free. The work is around them: keys generated with the right constraints, storage that survives a lost device, components that are not accidentally exported to every other app on the phone, and WebViews that do not hand your session to arbitrary JavaScript. This skill is for native (Kotlin / Java) Android apps. Flutter and React Native apps inherit the same platform surface — the manifest, Keystore, network security config, exported components, and backup rules all apply identically; only the code that calls them lives behind a plugin boundary. ## When to invoke - Shipping an Android app that holds credentials, tokens, or sensitive data - Before Play Store submission (where some checks are enforced; most are not) - After a mobile-app security advisory affecting your stack - Reviewing a third-party SDK before integration - Investigating an in-the-wild abuse report on a mobile app ## Android Keystore — generate keys the OS will defend Keystore keys are generated inside (and never leave) a hardware-backed environment on modern devices. Use it for the key that encrypts everything else — never hardcode or derive keys in app code. ```kotlin import android.security.keystore.KeyGenParameterSpec import android.security.keystore.KeyProperties import javax.crypto.KeyGenerator val spec = KeyGenParameterSpec.Builder( "vault_master_key", KeyProperties.PURPOSE_ENCRYPT or KeyP