Security notes Never put RSA private keys or OAuth AppSecrets in the APK. Sample uses Mock mode by default; switch to HTTPS baseUrl for production. Passwords are not stored in SharedPreferences (only last phone number). Debug builds log HTTP at BASIC level; release disables body logging. Historical keystore files (*.jks / *.keystore) at repo root are ignored by .gitignore and should be rotated/deleted if they were ever published.