Consumer ProGuard rules are shrinker rules that an Android library ships inside its AAR. When you add the library, the build appends them to your app's configuration, so you do not edit your own files. The effect can be that code you expected to be removed is kept.
How they work
The Android documentation says a library can include a proguard.txt and declare it with consumerProguardFiles in its Gradle configuration. When an app adds the library, those rules are added to the app's ProGuard configuration. The same page notes that if a library is part of a multi module build that produces an APK rather than an AAR, code shrinking should run on the consuming app module.
Why this touches security
Shrinking removes unused code, which shrinks the amount of library code that ships. A broad keep rule undoes that for the classes it matches. A vulnerable class that you assumed was stripped may remain in your release build.
This matters when you ask whether a vulnerable library is truly present. The answer depends on what your shrinker kept, not just what your build file lists. See if R8 removes unused library code, is my app still affected for the wider question.
What to review
| Item | Why |
|---|---|
| Broad keep rules for a whole package | Keeps everything in that package |
| Rules for reflection | May keep classes reachable just by name |
| Rules from every library | They stack, so one loose rule affects the app |
Steps
- Unzip the AAR and open
proguard.txtif it exists. - Search for rules that keep entire packages or all members.
- Build a release and compare the shrunk output with and without the library's rules, if you can.
- If a rule keeps more than needed, ask the maintainer, or add a narrower rule of your own where the build allows it.
- Record which libraries carry such rules.
- Re-check when you update the library, since rules can change between versions.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how knowing which code is actually reachable changes which findings matter.
Safeguard builds an SBOM and scans your dependencies for known vulnerabilities, and you can run a free scan at gold.safeguard.sh/scan to see what your own project pulls in.
Quick check
Do consumer rules apply automatically?
Yes. Per the Android documentation, the build appends them to your app's configuration when you add the library.
Does shrinking remove a vulnerable library for sure?
No. It removes unused code, and keep rules can retain classes. Check the release output.
Sources
Last reviewed: 19 October 2026.
