Android SDK 37

Apply these rules to an app compiled and targeting Android 17 (API level 37). Target-dependent protections require targetSdk 37; lowering it disables those protections. These OS protections require Android 17 at runtime; guard API 37 calls and define fallbacks when minSdk permits older devices.

Target level and release posture

• Set both compileSdk and targetSdk to 37 so the Android 17 protections that are gated on target level actually apply to the app.
• Treat a temporary targetSdk rollback as a security regression and track it, because local network blocking, contact restrictions, and code-loading hardening are all target-gated.
• Meet Google Play's target-API requirement: most new apps and updates must target at least API level 36 as of August 31, 2026, so API 37 is the forward-looking target, not the minimum.
• Leave android:debuggable out of AndroidManifest.xml so the build type controls it, keep isDebuggable = false on the release build type, and enable R8 shrinking and obfuscation there with optimization { enable = true } on AGP 9.3 and later or isMinifyEnabled = true on earlier AGP; confirm the signed release artifact is not debuggable so <debug-overrides> trust anchors never apply.
• Verify server-side that a request came from a genuine, unmodified build using the Play Integrity API; validate requestDetails against the request and its freshness before accepting integrity verdicts, instead of trusting a client-side rooted or tampered check.
• Do not rely on the app process staying alive for security cleanup: Android 17 memory limits