Android SDK 36

Apply the Kotlin 2.4 baseline first. These rules cover Android SDK 36 components, intents, permissions, storage, cryptography, networking, WebView, authentication, logging, build configuration, and release.

Components and intents

• Set android:exported explicitly on every component with an intent filter and export only the components that another app must invoke.
• Protect exported components with android:permission at signature protection level or verify the component's system-provided caller identity before touching protected data.
• Opt API 36 receiving components into android:intentMatchingFlags="enforceIntentFilter"; safer intent matching is not yet the default and none disables it per component.
• Use explicit intents for privileged calls and validate action, categories, normalized data URI, extras, component-specific caller identity, and granted URI permissions at receipt; getCallingPackage() is nullable and identifies an activity's result recipient.
• Create PendingIntents with FLAG_IMMUTABLE; if mutability is essential, make the base intent explicit and prevent fill-in fields from redirecting the operation.
• Validate nested intents before forwarding them and keep Android 16's launch protection enabled; do not call removeLaunchSecurityProtection() on untrusted intents.

Permissions and identity

• Request the minimum runtime permissions at the moment of need and handle denial without insecure fallback.
• Do not use device identifiers, package names, referrer data, or intent extras as proof of user identity.
• Recheck authorization for each