Android Developer Security Checklist: Complete Guide 2025

// ✅ SECURE: Proper authentication implementation
public class SecureAuth {
    private static final int MAX_LOGIN_ATTEMPTS = 3;
    private static final long LOCKOUT_DURATION = 15 * 60 * 1000; // 15 minutes
    
    public boolean authenticateUser(String username, String password) {
        // Check for account lockout
        if (isAccountLocked(username)) {
            return false;
        }
        
        // Validate credentials
        boolean isValid = validateCredentials(username, password);
        
        if (!isValid) {
            incrementFailedAttempts(username);
            return false;
        }
        
        // Reset failed attempts on successful login
        resetFailedAttempts(username);
        return true;
    }
    
    private boolean isAccountLocked(String username) {
        long lastFailedAttempt = getLastFailedAttempt(username);
        return (System.currentTimeMillis() - lastFailedAttempt) < LOCKOUT_DURATION;
    }
}

// ✅ SECURE: Encrypted data storage
public class SecureDataStorage {
    private static final String TRANSFORMATION = "AES/GCM/NoPadding";
    private static final String ANDROID_KEYSTORE = "AndroidKeyStore";
    
    public void storeSensitiveData(String key, String data) {
        try {
            SecretKey secretKey = getOrCreateSecretKey(key);
            Cipher cipher = Cipher.getInstance(TRANSFORMATION);
            cipher.init(Cipher.ENCRYPT_MODE, secretKey);
            
            byte[] encryptedData = cipher.doFinal(data.getBytes());
            // Store encrypted data securely
            storeEncryptedData(key, encryptedData);
        } catch (Exception e) {
            Log.e("Security", "Encryption failed", e);
        }
    }
    
    private SecretKey getOrCreateSecretKey(String keyAlias) throws Exception {
        KeyGenerator keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, ANDROID_KEYSTORE);
        KeyGenParameterSpec keyGenParameterSpec = new KeyGenParameterSpec.Builder(keyAlias,
                KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                .setUserAuthenticationRequired(true)
                .build();
        
        keyGenerator.init(keyGenParameterSpec);
        return keyGenerator.generateKey();
    }
}

// ✅ SECURE: Certificate pinning implementation
public class SecureNetworkClient {
    private static final String PINNED_CERTIFICATE = "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
    
    public OkHttpClient createSecureClient() {
        CertificatePinner certificatePinner = new CertificatePinner.Builder()
                .add("api.yourapp.com", PINNED_CERTIFICATE)
                .build();
        
        return new OkHttpClient.Builder()
                .certificatePinner(certificatePinner)
                .connectTimeout(30, TimeUnit.SECONDS)
                .readTimeout(30, TimeUnit.SECONDS)
                .writeTimeout(30, TimeUnit.SECONDS)
                .build();
    }
    
    // Always validate SSL certificates
    public boolean validateCertificate(X509Certificate certificate) {
        try {
            certificate.checkValidity();
            return true;
        } catch (CertificateExpiredException | CertificateNotYetValidException e) {
            Log.e("Security", "Certificate validation failed", e);
            return false;
        }
    }
}

// ✅ SECURE: Input validation and sanitization
public class SecureInputHandler {
    
    public String sanitizeInput(String userInput) {
        if (userInput == null || userInput.isEmpty()) {
            return "";
        }
        
        // Remove potentially dangerous characters
        String sanitized = userInput.replaceAll("[<>"'&]", "");
        
        // Limit input length
        if (sanitized.length() > MAX_INPUT_LENGTH) {
            sanitized = sanitized.substring(0, MAX_INPUT_LENGTH);
        }
        
        return sanitized.trim();
    }
    
    public boolean isValidEmail(String email) {
        if (email == null || email.isEmpty()) {
            return false;
        }
        
        String emailPattern = "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$";
        return email.matches(emailPattern);
    }
    
    // Prevent SQL injection
    public String buildSecureQuery(String table, String condition) {
        // Use parameterized queries instead of string concatenation
        return "SELECT * FROM " + table + " WHERE " + condition + " = ?";
    }
}