Android application development is primarily based on Java. The MITRE Java secure coding rules still apply to the Android security review. In addition, the Android application includes some unique building components that may introduce new security issues, such as Android manifest configurations, intents, activity, broadcast, content provider, and services:
- Android application secure design / secure coding guidebook by JSSEC
- Android developers documentation—app security best practices
- OWASP mobile security testing guide
For common security issues of APK, the App Security Improvement program of the Google Android developers provides the most recent security issues and the remediation advice, such as path traversal, insecure hostname verification, and fragment injection. It's also a good reference when the APK is submitted to...
