R8 build transformations and runtime defenses serve different purposes. A smaller or less readable package does not establish that critical operations are properly authorized.
Evaluation approach
Removing unused code and renaming symbols can affect dynamically accessed classes. Review protection-SDK rules alongside the application's reflection and serialization requirements.
Application example
If optimization prevents an event callback from running, identify the required access instead of broadly disabling rules.
Limits and considerations
Keeping the entire package can reduce obfuscation's effect. Disabling optimization can also conceal the underlying defect.
Why keep rules can affect security
R8 shrinking and optimization must match the application's dynamic access patterns. Incorrect handling of elements used through reflection or JNI can cause runtime errors. Broad rules that retain everything can reduce the expected transformations.
Understand why the vendor's recommended RASP rules are necessary. Connect release tests, diagnostic files and the distribution package to the same version. A working development build does not independently establish release compatibility.
Checks and decisions
- Narrow keep rules
- Retain mapping files
- Test the release build
Keep exceptions specific, and test the release variant through normal and failure flows.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.