Android App Security Check Service: Don't Wait for Your Customers to Find the Flaws
Android App Check from Rizal Consulting is a basic review for Android apps that you own. We assess three things: developer verification readiness, security weaknesses visible from the app package, and where user data flows, including through third-party SDKs. The result is an English report you can pass straight to your team, vendor, or legal counsel. The service is delivered online for clients around the world, exclusively for apps you own.
Table of Contents
Three things that can happen to your app without you noticing
1. Your app suddenly becomes hard to install. Since September 30, 2026, Android's developer verification protections have started running in Indonesia: checks begin with installs through Google's partner app stores, and Google plans to extend them to all apps on certified devices from 2027. Apps distributed outside Google Play need to be registered under a verified developer, and registration requires proof of identity and an APK signed with your private key. If your app is shared through a website or WhatsApp, or installed on employees' phones, and the signing key sits with a vendor you can no longer reach, you may struggle to prove the app is yours. Unregistered apps can still be installed through an advanced flow, but users must go through extra safeguards. That is not the experience you want for your customers.
2. A small flaw, a big loss. An app package (APK) can be opened by anyone. API keys, test server addresses, or passwords left inside it can be read without sophisticated tools. Meanwhile, scammers use fake APKs that pose as official apps, and the victims are your customers. Google's analysis found over 50 times more malware in apps installed from the open internet than in apps from Google Play. One customer fooled by a fake "app" carrying your brand is enough to damage the trust you have built for years.
3. Customer data flows to places you do not know about. Modern apps load many third-party SDKs for ads, analytics, and notifications. Each can send user data to servers you have never checked, including abroad. PP 33/2026 regulates data protection impact assessments, obligations toward data processors, and cross-border data transfers, and takes effect on January 16, 2027. Administrative fines can reach 2% of annual revenue. The supervisory agency is still being set up, but customers, business partners, and auditors will not wait for it before asking where their data goes.
Picture thirty days from now
Your app is registered under your name and installs without obstacles. You hold a tidy list: which SDKs are active, what data they send, to which domains, and which ones need to be stopped or reconfigured. The flaws that are easiest to exploit have been closed together with your development team. When clients, partners, or auditors ask, you answer with documents, not guesses. Preparing your Android app for PP 33 2026 no longer feels daunting because you know exactly where to start. And you can go back to focusing on what makes your business grow.
What you get from the Android App Check
Android developer verification outside Google Play: readiness check
We check the route that suits your app (Google Play Console or Android Developer Console), the completeness of your identity as an individual or organization, the package name status, and the state of your keystore and APK signing. For organizations, we also make sure the organization's website is ready to be verified through Search Console. You get step-by-step guidance until the submission is ready to send. The final verification decision rests with Google, so we do not promise approval. The official guidance is in Google's Android developer verification guide.
Static security review: check permissions and hardcoded secrets in Android apps
We dissect the app package without attacking your server: the manifest file, excessive permissions, components exposed to other apps, network configuration, debug and backup settings, and embedded secrets such as API keys, tokens, and passwords. Findings are mapped to OWASP MASVS, the industry standard reference for mobile app security.
Android app data flow map and third-party SDK audit for Android apps
We observe your app's traffic in a test environment to record which SDKs are active, the destination domains, the types of data sent, and whether the transmission is encrypted. The result is a map you can take to your legal counsel to assess readiness for PP 33/2026, for example regarding agreements with data processors and cross-border transfers. We provide technical data, not legal opinion.
We review native apps (Kotlin or Java), WebView or hybrid apps, Flutter, and React Native.
How it works
- Initial consultation via WhatsApp. You tell us about the app, we confirm that it falls within scope and choose a package together with you, before you pay anything.
- Testing authorization letter and NDA. We only review apps that you own, with written permission.
- Send the release files. The release APK or AAB, a test account if needed, and a list of the SDKs you know about.
- Review. Carried out according to the package you chose.
- Report and online walkthrough. An English PDF report containing an executive summary, findings with their risk levels, evidence, and remediation steps that can go straight to your developers.
Packages and pricing
| Package | What is included | Turnaround | Price |
|---|---|---|---|
| Verification Ready | Developer verification readiness | 2–3 business days | $99 |
| Security Check | Verification Ready plus static security review | 5 business days | $299 |
| Full Check | Security Check plus data flow map and third-party SDK audit | 7 business days | $599 |
Turnaround is counted from the moment your files are complete. Flutter or React Native apps on the Security Check and Full Check packages carry a surcharge of $49. Very large apps or apps protected by heavy obfuscation are quoted after the initial consultation. Google's developer account fee is paid by you directly to Google. Prices are in US dollars. Payment to Rizal Consulting is by international bank transfer (including Wise), Payoneer, RIA Money Transfer, Touch 'n Go eWallet, Topremit, Remitly, or secure online checkout.
Limits you should know before ordering
- This is a basic review, not a penetration test and not a security certification.
- Testing of servers, APIs, and backends is not included. We only observe what the app sends.
- This is not legal advice, and it does not guarantee compliance with the PDP Law or PP 33/2026. Use the report as material for your legal counsel.
- Verification approval rests with Google and we cannot guarantee it.
- Retesting after fixes is not included in the packages.
- Only for Android apps that you own. We do not serve iOS apps or apps owned by other parties.
- For banks and regulated financial institutions, testing needs are better handled by certified testing firms.
Why Rizal Consulting
Rizal Consulting has worked in IT since 2006 and serves clients online from Indonesia. Our reports are in English and written with local context: Indonesia's PDP Law, the habit of sharing APKs over WhatsApp, and the new developer verification rules. We are also open about the limits of the service, because an honest report is more useful than a promise we cannot keep. Once the report is done, you can continue the fixes through our IT consulting service.
Frequently asked questions
What is Android developer verification outside Google Play, and does it apply to my app?
Since September 30, 2026, Google has started running developer verification checks in Indonesia, beginning with installs through partner app stores, and plans to extend them to all certified Android devices in 2027. Apps on Google Play are generally registered automatically, while apps shared only outside Play need to be registered through the Android Developer Console. Unregistered apps can still be installed through an advanced flow with extra steps. If your app is used by customers or employees on Android phones, it pays to be ready before the rules widen.
How to register an Android package name?
There are three steps: create an account in Google Play Console or Android Developer Console, verify your identity as an individual or organization, then register the package name by uploading an APK signed with your private key. A full developer account carries a one-time USD 25 fee paid to Google. We help prepare the files and make sure no step is missed.
Lost Android keystore: what can you do?
Android only accepts app updates signed with the same key as the installed version, and package name registration requires an APK signed with that key. The first step is to look for a backup with your vendor, in your code repository, or in old storage. For apps on Google Play that use Play App Signing, Google provides a procedure for replacing the upload key. If the key truly cannot be found, the usual option is to publish the app under a new package name and a new key. We help map the options for your case, without promising that the old key can be recovered.
How is the Android App Check different from a penetration test?
A penetration test simulates a full-scale attack, including against servers and APIs, and is usually carried out by a certified team at a much higher cost. The Android App Check is a basic review of the app package and its data flows, suited as a first step before you decide whether you need deeper testing.
Does an Android app privacy check for the PDP law make my app automatically compliant?
No. The service produces technical data about what your app collects and sends. PP 33/2026 only comes into force on January 16, 2027 and carries obligations far broader than the technical side of an app. Use our report as material for discussion with your legal counsel.
Is a third-party SDK audit for Android apps necessary for small apps?
Yes, especially if your app loads ads, analytics, notifications, maps, or payments. These usually arrive as third-party SDKs that can send user data to servers outside your control. Even small apps often load several SDKs without the owner noticing.
Can a Flutter and React Native app security review be done?
Yes, for an additional $49 on the Security Check and Full Check packages. Flutter and React Native app logic is often already compiled, which makes it harder to read, so the scope of findings may be narrower than for a native app. We state that limit plainly in the report so you know which parts have and have not been examined.
Is an Android app security check for small businesses available?
Yes. Packages start at $99 and are delivered online. The service suits owners of vendor-built apps, such as online shops, schools, clinics, or service companies, who want to know the state of their app without paying for a corporate-scale test.
How long does it take, and what do I need to prepare?
The Verification Ready package takes 2–3 business days, Security Check takes 5 business days, and Full Check takes 7 business days, counted from the moment your files are complete. Prepare the release APK or AAB, a test account if the app requires login, and a list of the SDKs you know about. We provide the testing authorization letter and NDA.
How is the confidentiality of my app files protected?
Every engagement begins with an NDA and a testing authorization letter. Your app files and the report are used only for your review, and we delete them at your request once the project is finished.
Today you can still find the flaw first
Every day your app circulates unchecked is a day when someone else can find its flaws before you do. But today you can still be the one who finds them, closes them, and shows the proof. Start with one message: chat with Rizal Consulting on WhatsApp or email
📌 Rizal Consulting: IT Consulting and Support Services
✉️
📱 +62 813-8229-7207 (WhatsApp)
⏰ Saturday–Thursday, 08:00–17:30 WIB (UTC+7)
