I am working on an Android app for a client. The app is practically finished, and next week I’ll have a meeting with the client to present it. He’ll test everything, and upon approving it he will make the payment and I’ll give him the source code and publish it on Google Play.
Today he called me asking for the Apk so that he can start testing it. I am worried that if we don’t close the deal (for one reason or another) he might get someone to reverse engineer the Apk and get my source code/app anyway, even if obfuscated with ProGuard (I never tried, but according to this SO thread it’s not that difficult to reverse engineer an Apk).
My question: Am I being paranoid here and should just send the client the Apk (cause perhaps the ProGuard obfuscation is enough to make the source code useless) , or are my worries reasonable and I should stick to getting paid before delivering anything?
Have you ever reverse engineered an .apk? Probably you did, but were you able to recreate the whole app? Probably not. Following your logic it would mean that I could “easily” reverse engineer any popular app and use it for me. It’s true that you can look through most code, if it’s not obfuscated, but the technique isn’t perfect. Sometimes it still fails to convert Smali into real Java code. It gets harder the more complex your app is. To answer your question: no don’t be worried, but you should still (always) use ProGuard.