Build and distribution
Signing, migrations, supply-chain integrity and store delivery.
Android upload keys and app signing keys
Upload keys and application signing keys can serve different roles. Reflect that distinction in access management and recovery.
Read the guideAPK signature schemes and verification scope
Signature schemes differ in integrity and compatibility properties. Evaluate signing configuration against supported Android targets.
Read the guideProtection compatibility during Android signing-key rotation
Key transitions can affect certificate checks, application recognition and server integrity policy as well as publication.
Read the guideProtection coverage in split APK distribution
An Android installation may contain several splits. Testing one local APK may miss parts of actual distribution.
Read the guideSecurity controls in dynamic feature modules
Downloaded features can change the code present after startup. Cover loading and first use in the protection plan.
Read the guideAndroid ABI coverage and protection tests
Native protection components may ship different binaries for each architecture. Each ABI needs security and stability acceptance.
Read the guideAndroid page-size compatibility for security SDKs
Native-library page-size compatibility can affect operation on newer devices. Security SDKs belong in that review.
Read the guideiOS provisioning and protection configuration
Provisioning and signing determine distribution identity. Protection must align with that identity and permitted capabilities.
Read the guideComparing iOS distribution entitlements
Entitlements define platform capabilities. Unexpected additions or removals between testing and release can change behavior.
Read the guideSymbol archives for protected iOS releases
Crash analysis requires symbols matching the shipped version. Hardening can make accurate mapping even more important.
Read the guideReproducibility in mobile builds
Reproducible builds aim to produce expected outputs from defined sources and environments. Protection randomness or environment dependence can affect that goal.
Read the guideLocking dependencies in mobile projects
Changing dependency resolution can produce different artifacts from the same source. Locking makes selected versions reviewable.
Read the guideVerifying downloaded build dependencies
A package name and version do not prove that the expected file was downloaded. Verification links downloads to trusted artifacts.
Read the guideBinding a mobile SBOM to a release
An SBOM should represent the actual protected, distributed package. A source-repository inventory alone may be incomplete.
Read the guideSigstore and mobile artifact provenance
Artifact signing connects output to a publication process. Sigstore is an ecosystem used for that purpose.
Read the guideWhat belongs in mobile build provenance?
Provenance explains the source, tooling and process behind an artifact, supporting later investigation.
Read the guideSigning secrets in mobile CI pipelines
Signing keys and publication tokens are high-value pipeline assets. Keep them out of repositories and logs.
Read the guideSeparation of duties in mobile release approval
Unrestricted power to change source, disable protection and publish signed packages concentrates risk.
Read the guideArtifact checksums for FTP and store delivery
Checksums help confirm that delivered files match approved packages. Hash the final modified artifact.
Read the guideData compatibility when rolling back mobile releases
Rollback is more than redistributing old code. New formats and key states may be incompatible with it.
Read the guideEnding support for older mobile versions safely
Old applications retain old security behavior. End-of-support policy must account for both protection and access.
Read the guidePackage identity and environment separation
Package names and bundle IDs are important identity components. Mixing test and production creates incorrect trust relationships.
Read the guideBuild flags and security features
Flags help testing and feature selection. Verify security-relevant flags explicitly in release gates.
Read the guideUpdating privacy disclosures after SDK changes
Security SDK updates can introduce different data or API use. Review store privacy disclosures alongside compatibility.
Read the guideA pre-release security evidence package
Release decisions need more than scan-report counts. Show scope, critical-flow results and accepted exceptions together.
Read the guide