Android Debugging Enabled

kotlin.android_debugging_enabled

Severity

high

Resource

Entry Points

Language

Kotlin

Description

Leaving debugging enabled in a release application can expose sensitive data and application logic, leading to security vulnerabilities.

Rationale

Debugging features provide developers with detailed logs and stack traces that are invaluable during development but potentially harmful if left enabled in production. When android:debuggable is set to true, it allows attackers to connect debuggers and access sensitive information, including secret keys and private user data, thus increasing the risk of exploitation.

Ensuring that debugging is disabled in release builds is crucial to maintaining application security.

<application
    android:debuggable="true"
    ... >
    ...
</application>

Remediation

To secure your application, ensure that android:debuggable is set to false in your manifest file. Typically, this is handled automatically by build tools, setting it to false for release builds. However, it’s essential to verify this configuration to prevent accidental exposure.

Additionally, review build configurations to ensure difference between debug and release settings is clear and properly managed.

<application
    android:debuggable="false"
    ... >
    ...
</application>

References

CWE-489 : Active Debug Code.
Debuggable attribute