Kotlin and Android secure coding¶

Kotlin null safety does not determine whether another application can launch a component or whether an intent is authorized. Android applications written in Kotlin need a review of both source code and the merged release manifest. Server-side Kotlin also needs the database and request controls described in the Java guide.

Keep internal activities private¶

Suppose an activity displays an internal administration screen and is never intended as a launcher or a deep-link destination. These fragments belong inside the manifest's application element.

Unsafe for this internal-only screen: export it without a permission boundary.

<activity
    android:name=".InternalAdminActivity"
    android:exported="true" />

Safer: explicitly keep it inside the application.

<activity
    android:name=".InternalAdminActivity"
    android:exported="false" />

The exported setting controls whether components from other applications can start this activity, subject to Android's component rules. See the Android activity manifest reference. An exported component is not automatically a vulnerability: launcher activities, intentional deep links and integrations have different requirements.

A component that must be exported needs appropriate caller restrictions and server-side authorization for sensitive operations. Never treat an intent extra such as isAdmin=true as proof of privilege. Validate received URLs, identifiers and file references before using them. Also inspect manifest changes introduced by libraries and build variants.

Check the fix¶

Build a release variant and inspect its merged manifest. Verify that the internal activity remains non-exported after manifest merging. From a separate, disposable test application, attempt to launch only this synthetic activity and confirm access is denied. Then verify normal navigation inside your app still works. Do not change a production device's security settings to make the test pass.

Review exported components, hardcoded credentials, TLS validation and WebView XSS. Android source review and packaged APK analysis answer different questions; inspect both code findings and manifest evidence.

The example shows one configuration boundary. It does not establish complete Android coverage, prove authorization logic, or certify a mobile package because no findings were returned.