Manifest inspection of the supplied package found debuggable, allowBackup and usesCleartextTraffic enabled. These declarations are relevant build characteristics, not a complete account of runtime behaviour. The project has not established an independent malware assessment, publisher-signing ownership or a full privacy audit of the application.
Read flags as declarations
A cleartext-traffic permission does not prove every request uses HTTP, just as an allowed backup flag does not prove every kind of data is backed up on every device. Runtime behaviour requires separate testing.
Keep claims proportionate
A supplied installer should not be described as independently security-certified merely because it installs or has a published hash. Those checks answer different questions.
Choose an informed route
Review the current source and ask support about the maintained distribution build if these characteristics matter to your setup. A supported third-party player is a separate software choice with its own terms.
A practical sequence
0 of 3 steps completed on this page.
An example to work through
A matching SHA-256 value can confirm the supplied file while leaving questions about its runtime network behaviour unanswered.
Questions about this topic
Does debuggable automatically prove malicious behaviour?
No. It is a build flag, not a complete security verdict.
Does usesCleartextTraffic prove every connection is unencrypted?
No. It permits relevant traffic; actual connections need separate observation.
