Android Security & Privacy

Remove API Keys from code: Do not leave secret keys in source code; use `local.properties` or Gradle Secrets Plugin. Review Manifest Permissions: Remove unnecessary sensitive permissions (such as Camera, Background Location, or SMS). Secure HTTPS Traffic: Ensure all network calls use HTTPS and keep `usesCleartextTraffic="false"`. Protect Exported Components: Ensure `android:exported="false"` on private Activities, Services, and Receivers. Secure Data Storage: Use EncryptedSharedPreferences or DataStore to save tokens and sensitive user data. App Signing KeyStore Backup: Backup the production release key (`.jks`/`.keystore`) and passwords in a secure location.