Code Security · Obfuscation · Crypto (Android)

Executive summary

Solid baseline: R8 + resource shrinking enabled in release, AES-256-GCM via Android Keystore for token encryption, BiometricPrompt for member-card unlock, NowSecure scans in CI. Notable gaps: API keys committed in gradle.properties, no Play Integrity / SafetyNet, no root detection, FLAG_SECURE absent on payment screens, R8 keep-rules likely over-broad (Hilt/Room/Retrofit annotations require careful exclusions), and one new Random() use in a non-test path.

1. Code obfuscation — R8 / ProGuard

Configuration today

Common R8 keep-rule gotchas to verify

R8 in full mode is aggressive. The following classes / patterns must be kept or your release builds break in subtle ways:

# Hilt-generated code
-keep class dagger.hilt.** { *; }
-keep class * extends dagger.hilt.android.internal.lifecycle.HiltViewModelFactory { *; }

# Retrofit + Moshi/kotlinx-serialization
-keepattributes Signature
-keepattributes Exceptions
-keepclasseswithmembers,allowshrinking,allowobfuscation interface * {
    @retrofit2.http.* <methods>;
}
# kotlinx-serialization adapter requires @Serializable types kept
-keepclasseswithmembers class * {
    @kotlinx.serialization.Serializable <methods>;
}

# Room — entities + DAOs cannot be obfuscated
-keep class * extends androidx.room.RoomDatabase
-keep @androidx.room.Entity class *
-keep @androidx.room.Dao interface *

# Glide / Coil — modules and registered components
-keep public class * implements com.bumptech.glide.module.GlideModule

# Firebase Crashlytics — symbolication needs un-mangled stack frames
-keepattributes SourceFile,LineNumberTable
-keep class com.google.firebase.crashlytics.** { *; }

# WebView JS interface methods
-keepclassmembers class * {
    @android.webkit.JavascriptInterface <methods>;
}

Findings

2. Cryptographic primitives — what's used, where

Inventory of crypto-relevant code paths identified in static review:

Findings

3. Secret management — hardcoded keys audit

The Maps API key problem

// local.properties (gitignored)
MAPS_API_KEY=AIza...

// Costco/build.gradle
android {
    defaultConfig {
        def localProps = new Properties()
        rootProject.file("local.properties").withInputStream { localProps.load(it) }
        manifestPlaceholders = [MAPS_API_KEY: localProps['MAPS_API_KEY'] ?: ""]
    }
}

<!-- AndroidManifest.xml -->
<meta-data
    android:name="com.google.android.geo.API_KEY"
    android:value="${MAPS_API_KEY}"/>

Other hardcoded URL audit

CategoryLandingAnalyticsHelperImpl.kt:189 and CategoryLandingViewModel.kt:600 hardcode https://www.costco.com / .ca. Not a secret, but configuration that should come from BuildConfig or remote config.

4. Anti-tampering / anti-debugging / root detection

// MainActivity / each sensitive Activity
override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    if (isSensitiveScreen()) {
        window.setFlags(
            WindowManager.LayoutParams.FLAG_SECURE,
            WindowManager.LayoutParams.FLAG_SECURE
        )
    }
}

5. Token & session security

6. Memory safety — wiping sensitive data

Java/Kotlin Strings are immutable and live until garbage collection. After decryption, sensitive data should land in char[] or byte[] and be zeroed when done. Sample of patterns to use:

// Better than String for passwords/tokens
fun authenticate(username: String, password: CharArray): Result {
    try {
        return doAuthenticate(username, password)
    } finally {
        Arrays.fill(password, ' ')  // zero the array
    }
}

// For byte arrays
val tokenBytes = decryptToken()
try {
    network.send(buildRequest(tokenBytes))
} finally {
    java.util.Arrays.fill(tokenBytes, 0.toByte())
}

Recommendation: Audit the auth flow for String usage of decrypted tokens; convert to CharArray + zero in finally.

7. Secure logging

The Lint Report identifies 231 Log.* calls and 24 print/Log.d sites in production code. Without a release-build filter, these can leak PII to logcat — accessible to any app with diagnostic entitlements (or ADB on USB-debug devices).

// Application.onCreate — install a release tree that scrubs and forwards to Crashlytics
class CostcoApplication : Application() {
    override fun onCreate() {
        super.onCreate()
        if (BuildConfig.DEBUG) {
            Timber.plant(Timber.DebugTree())
        } else {
            Timber.plant(ReleaseTree())
        }
    }
}

class ReleaseTree : Timber.Tree() {
    override fun log(priority: Int, tag: String?, message: String, t: Throwable?) {
        if (priority < Log.WARN) return  // drop verbose/debug/info entirely
        val scrubbed = scrubPii(message)
        if (t != null) {
            FirebaseCrashlytics.getInstance().recordException(t)
        }
        FirebaseCrashlytics.getInstance().log("${'$'}{tag ?: ""}: ${'$'}scrubbed")
    }

    private fun scrubPii(s: String): String =
        s.replace(EMAIL_REGEX, "[email]")
         .replace(MEMBER_ID_REGEX, "[member]")
         .replace(PHONE_REGEX, "[phone]")
}

8. Code signing & distribution integrity

9. Recommendations summary (prioritized)