Development settings can broaden inspection and tampering access if shipped. Check the final manifest, not only the source file.
Evaluation approach
Review variants and merged manifests together. Include test-only permissions and network exceptions in the same gate.
Application example
Inspect the release APK in CI for its debuggable setting. A successful build does not establish that this condition was met.
Limits and considerations
The correct flag alone does not provide comprehensive anti-debugging or reverse-engineering resistance.
What should the gate examine?
Inspect the final artifact intended for signing rather than the manifest in version control. Merging or protection steps may change later files. Include the examined package hash in the report.
Checks and decisions
- Inspect the final manifest
- Separate variants
- Automate the gate
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.