Best practices in app security
summary
Creates and signs every build with a single release keystore stored outside git and referenced via env vars to avoid lost keys and accidental resigning; enables obfuscation (ProGuard or commercial protectors) from day one so builds don’t suddenly fail; verifies signing and installer at runtime and detects rooted/emulated devices after Crashlytics showed fake-device crash spikes; encrypts local data rather than relying on a user PIN (only 10,000 4‑digit combos) or patterns (~389000); uses HTTPS plus certificate pinning and the Android M network security config for predictable rollouts.
AI-written summary · about
chapters (14)
- 0:00Start
- 7:15Enable Obfuscation
- 7:55Problems with Proguard
- 8:35Staging versus Production
- 11:37Verify Signing Certificate
- 12:12Crash Reports
- 12:56Data Privacy
- 20:54Network Security
- 22:47Pinning Certificates
- 29:05Fingerprint Api
- 30:54Network Security Configuration
- 31:27Configuration
- 31:41Trust Anchors
- 32:35Lead by Example
