Resources
Guides, checklists and templates published on androidsecurity.in.
Downloads
Free, no obligation. We email a confirmation link, then the file.
Guides and templates
What a Play Integrity verdict actually returns, and who it is evidence for
The Play Integrity API returns three families of verdict, and the labels most conversations about it are really about are not among the ones you get by default. This is what Google documents it returning, the limits Google publishes about its own product, and the reason every documented Android integrity primitive ends up producing evidence for a server rather than an answer for a device. Read 3 September 2026.
Google Play reads your manifest, not your code path
Google Play's restricted-permission rules are written against what an app declares, not against what it calls. An app that never invokes an API can still carry the permission line in its merged manifest, because a library put it there. That is a store problem before it is a runtime one. The SMS and Call Log groups, QUERY_ALL_PACKAGES, and the eight permissions barred outright from personal loan apps, read off Google's own policy pages. Read 3 September 2026.
Your Data safety form is a declaration about a binary, and the binary keeps changing
Google Play's Data safety form binds every developer with a published app. It covers data handled by third-party libraries and SDKs as well as your own code, and Google's position on who answers for it is one sentence long: you alone are responsible. That makes it one of the few store obligations you can actually check. A declaration and a merged manifest are two artefacts, and they can be read against each other. Read 3 September 2026.
Android security advice that expired: fourteen statements, and the version that ended each one
Fourteen statements about Android security that were correct when somebody learned them and are not correct now. Each one is paired with the API level, the Android Gradle Plugin version or the Google turndown that falsified it, the platform page it was read from, and that page's own last-updated stamp. Google revises these pages independently, and a claim without a stamp cannot be re-checked. Read 3 September 2026.
Android 16 is now the submission gate: target API 36, and what the 1 November window actually is
Since 31 August 2026, Google Play has applied two requirements to two different sets of apps under one date, with two very different verbs. A new app or an app update must target Android 16 (API level 36) or higher to be submitted. An app already on Play must target Android 15 (API level 35) or higher to stay available to new users on newer devices. A team that has not shipped an update since it moved to API 35 is compliant on availability and blocked on submission the moment it tries to ship. Checked 2 September 2026.
The manifest two authorities regulate: RBI paragraph 12(i) and Google Play's Financial Services permission list
Two instruments reach the same AndroidManifest.xml. The Reserve Bank of India (Digital Lending) Directions, 2025 name the phone resources a Digital Lending App must desist from accessing, in prose, and permit a one-time access for on-boarding/KYC with the borrower's explicit consent. Google Play's Financial Services policy names eight Android permission constants for personal loan apps. Google's SMS and Call Log rule is written on what an app declares in its manifest, and says so in terms, placeholder text included. That puts the merged manifest, and every library that contributes a uses-permission line to it, inside the question. And a named Chief Compliance Officer of the Regulated Entity certifies that data collection and storage by DLAs comply with para 12 and 13. Every quotation checked 2 September 2026.
Every Play package must be registered by 30 September 2026 — and the install-side milestone is a different obligation
Two obligations, one date. Install-side verification enforcement begins on 30 September 2026 for users installing from seven named stores in Brazil, Indonesia, Singapore and Thailand, on certified devices running Android 7+. Separately, on the same date, all Play packages must be registered under Android developer verification, and Google's own word for the consequence is global removal from Google Play. Registration is decided on app signing key ownership and install share, so a rotated upload key, an agency-held key, or one package name shipping from two keys has to be resolved before the package can be registered. Every quotation checked 2 September 2026.