Apps shipping a debuggable build

What this finding means, and why so few apps have it

android:debuggable="true" turns on the Java debug wire protocol for an app. Anyone with access to the device can attach a debugger, inspect and modify memory, call methods, and run code in the app's own identity, which means reading everything in its private storage.

This category lists 1 app. That is not a detection failure: Google Play rejects an upload whose manifest sets this flag, so a build with it cannot normally reach the store at all. The check exists because the store is not the only way an app is distributed.

Where you will find this is in sideloaded builds, in APKs served directly from a website, in enterprise and alternative-store distribution, and in a release built from the wrong Gradle variant that never went through Play's checks.

Why it matters when it does happen

Everything an app can do, a debugger attached to it can do. Private files, including token stores and databases, are readable. Pinned-certificate logic can be bypassed in memory. Checks you wrote to run once can be made to return whatever answer is convenient.

The flag defeats defences rather than exploiting a specific bug, which is why it is reported at high severity on the rare occasions it appears. It is also one of the very few findings in this corpus with no legitimate reason to be in a release build.

How to fix it

• Remove android:debuggable from the manifest entirely and let the build type control it. The debug variant sets it; the release variant must not.
• Check for a manifest merge introducing it from a library or a flavour-specific manifest, which is the usual cause when nobody set it deliberately.
• Verify the shipped artifact rather than the source: read the flag back out of the built APK in CI, since that is what users actually install.
• If you distribute outside Play, add that check to your release pipeline, because nothing else will do it for you.

How we detect it

The attribute is read directly from the binary manifest of the analysed APK. There is no inference and no heuristic: the flag is either set in the artifact or it is not.