Your app contains unsafe cryptographic encryption patterns (in dynamically loaded code)

Question

This recently popped out pre-launch report, once I published minor update to app.

I've seen also couple of similar recently in other projects, with class names obfuscated in exactly same name (bjqm.* , bpce.*).

I wonder whats causing it (which dep)? Note that it's dynamically loaded code. These classes are nowhere to be seen in "obfuscation mapping.txt", I didn't catch classes either in heap dump. Also I've tried to submit app without obfuscation into internal builds, but these classes are still scrambled / obfuscated in pre-launch report.

It seems Google has updated static analyzers recently as minor change I did in codebase doesn't cause it.

Answer 1

I am having EXACTLY the same issue with completely identical messages, but they seem to appear randomly. I successfully sumbitted the latest version of my app yesterday and it was published to the Store. When I look at that release in the Dashboard this morning, the two errors have been added. The same happened for a previous release. What is going on?

By the way, as a newbie, I wanted to add a comment to the original question, but I'm not allowed to. Apologies if adding an answer isn't correct protocol.

Answer 2

I resubmitted another build of app with zero changes, and "Unsafe encryption" and "Implicit Pending Intent" errors are gone :)