The release build of an application is generally meant for distribution to end users. By making this target debuggable, you expose your application to unnecessary risks. Debug instructions or error messages can leak detailed information about the system, like the application’s path or file names.
When you build a release version of your application, you're creating a distributable package of your code. Making release builds debuggable will make it much easier for someone to reverse-engineer your application. This means they can potentially understand your code's logic, extract sensitive information like API keys, or even modify your application for malicious purposes.
Release builds are meant for distribution to end users and is therefore under constant scrutiny. Making these builds debuggable creates a serious vulnerability. While debugging builds can be used for troubleshooting, failing to enable it for release builds exposes your application to unnecessary risks.
== How to fix it in Android
=== Code examples
==== Noncompliant code example
[source,kotlin,diff-id=1,diff-type=noncompliant]
----
android {
buildTypes {
release {
isDebuggable = true // Sensitive
}
}
}
----
==== Compliant solution
[source,kotlin,diff-id=1,diff-type=compliant]
----
android {
buildTypes {
release {
isDebuggable = false
}
}
}
----
== Resources
=== Documentation
* https://developer.android.com/studio/publish/preparing[developer.android.com] - Prepare for release
