Integration

sentry-android

Build System

Gradle

AGP Version

8.6

Proguard

Enabled

Version

7.6

Steps to Reproduce

We use AppSweep by Guardsquare for security scans of our Android application. When scanning our minified release APK we see a security warning because of an "insecure HTTP URL" shipped in our code. The reported URL is http://10.0.2.2:8969/stream.

It seems like this was added with the spotlight integration: #3166

We do not use this feature and would like to prevent shipping this URL to avoid issues with security services like e.g. AppSweep or other external security pentests which we regularly need to pass

Expected Result

Sentry SDK does not add insecure HTTP URLs to production code

Actual Result

Minified Android APK contains http://10.0.2.2:8969/stream