Before installing a mobile app that touches your code, alerts or accounts, check what permissions it asks for, whether it uses encrypted connections, how it signs you in, what it stores on the device, and how it updates. Install from an official store when you can, and verify any direct download.
Why vet it at all
A mobile developer tool often holds a token for your code host, cloud account or security platform. If the app is careless, that token is the prize. You do not need to read source code to catch the common problems. Android's developer security guidance describes what a well built app does, which gives you a user side checklist.
Permissions
Android's guidance says to request the minimum set of permissions, and to avoid permissions entirely when possible. Apply the same standard as a user. A vulnerability alert viewer does not need your contacts, microphone or precise location. When you install, read the permission prompts. If a request does not match the tool's job, skip the app or ask the vendor why.
Network use
The guidance says to use HTTPS wherever the server supports it, especially on untrusted networks like public Wi-Fi, and to block cleartext traffic with a network security configuration. Look for a statement about encrypted connections in the vendor's security page. A vendor that cannot say plainly whether traffic is encrypted is a warning.
Sign-in
The guidance suggests avoiding unnecessary credential prompts, using short lived, service specific tokens, and not storing user IDs and passwords on the device. It also points to Credential Manager for passkeys, passwords and federated sign-in, and biometric authentication for sensitive apps. Ask:
- Does the app support passkeys or single sign-on, so it never sees your password?
- Does it ask for a long lived token, or use short lived ones?
- Can you see and revoke its sessions from the vendor's account page?
See passkeys for developer accounts.
Data on the device
Android's guidance says internal storage is private to the app by default, while external storage is globally readable and writable and should hold only non-sensitive data. It also says not to log personally identifiable information, since logs are readable by apps with the right permission. As a user, you can check: does the app work without saving exports to shared storage? Does it offer a way to clear cached data? Does it hide content in notifications?
Updates and where it comes from
Install from an official store when possible. Some vendors also offer a direct download for phones without the store. If you use one, verify it before installing: compare the published checksum and, on Android, check the signing certificate with the apksigner tool. Android's documentation describes apksigner verify, with a print-certs option that shows the signing certificate information, and a modified APK has an invalid signature. Compare the certificate fingerprint to one the vendor publishes through a separate channel. Updates for a direct download come from the vendor and not from the store, so you must keep it updated yourself. See verifying an Android APK.
A five minute checklist
- Source: official store, or a verified direct download.
- Permissions: only what the tool needs.
- Network: encrypted connections stated.
- Sign-in: passkey or SSO, revocable sessions.
- Storage: nothing sensitive in shared storage or logs.
- Support: a security contact, and a visible update history.
- Exit: you know how to revoke its access and remove it.
Quick check
Is an app from the official store automatically safe?
No. Stores reduce some risks but cannot guarantee an app's behavior. Still check permissions, sign-in and what the vendor says about data handling.
How do I check a directly downloaded Android APK?
Compare its checksum with the vendor's published value and run apksigner verify with the print-certs option, then compare the certificate to one published through a separate channel.
Sources
Last reviewed: 19 October 2026.
