Your first app in 5 minutes flat
# Move
1 aistudio.google.com/apps → Build mode
2 Switch platform to Android
3 Type your idea like a text. Blank? Hit “I’m Feeling Lucky”
4 Watch it run on a fake phone (an emulator — a phone faked inside your browser)
5 Plug your real phone in via USB → installs straight on
Tested it with a “What to Eat Today” app — done in 5 min. Random picker, spinning wheel, saved history. Looks needed a tidy, bones were solid.
Trick: one clean sentence → build → then say “add dark mode.” Dumping your whole wishlist at once confuses the AI same as it would a person.
The arsenal — 15 free tools to break it + bulletproof it
Read the code (decompile):
| Tool | What it does |
|---|
| jadx | APK → readable code. The baseline. |
| apktool | Unpack + repack. grep -r "api_key" the output. |
| Bytecode-Viewer | 5 decompilers side-by-side for a second opinion. |
| jadx-ai-mcp | Rare gem — an AI drives jadx: “find the hardcoded key” in plain English. |
| Ghidra | NSA’s free reverser for deep native digging. |
Hunt for leaks (scan):
| Tool | What it does |
|---|
| MobSF | Drag-drop APK → full security score. |
| APKLeaks | One command → every URL, endpoint, secret. |
| trufflehog | 800+ secret types — and live-checks if they still work. |
| gitleaks | Guards the GitHub repo — blocks a key before commit. |
| apknuke | Fires key-pattern scans at a decompiled APK. |
Lock it down (harden):
| Tool | What it does |
|---|
| R8 / ProGuard | Already in your Gradle file — minifyEnabled true. Renames + shrinks. Slows readers; does NOT hide secrets alone. |
| LSParanoid | The bit R8 misses — scrambles strings so keys aren’t plain text. |
| Obfuscapk | Obfuscates the APK with zero source edits. |
| TrustKit | Cert pinning — kills traffic snooping. |
| OWASP MASTG | The free bible pros test against. |
