Guide

Protect your app during beta testing

Letting strangers install your unreleased app feels risky. Here is what is actually at risk, what is not, and the steps that close the gap.

What a tester can and cannot take

• They do not get your source code. They get the same compiled build the public gets on launch day. Decompiling it is possible but takes real effort and exposes nothing you would not ship anyway.
• They can see the idea, screens and unreleased features, and could describe or screenshot them. That is the realistic risk, and it is reputational more than technical.
• They can find secrets you left in the build: API keys, admin endpoints, debug flags. This is the one risk that is entirely in your control.

What BetaTesters does

• NDA at claim. Every tester accepts a confidentiality agreement before a slot is granted. You get a signed record with their name, timestamp, IP address and verified identities.
• Confidential listings. Hide the app name, description and install link from the public browse page. Testers see the category, reward and duration, and the details only after accepting the NDA. Confidential listings require Verified testers.
• Verified identities. Testers link Google, X, GitHub or a verified phone. One account per person is enforced across those identities.
• Report and ban. Report a tester from your dashboard. Upheld reports forfeit their balance and ban them, including their linked identities and phone, so they cannot return under a new email.
• Traceable installs. Google's closed-test opt-in ties every install to a Google account you added, so a leaked build points at the account that received it.

What you should do

1. Strip secrets from the client. No API keys, admin tokens or private endpoints in the APK. Use a backend proxy and short-lived tokens.
2. Use a test backend. Point the closed-test build at sandboxed APIs and test accounts, not production data.
3. Gate unreleased features behind server flags. Ship the build with the features you need tested; keep the rest off until launch.
4. Watermark the build. Show a build ID or the tester's email on an About screen so screenshots are traceable.
5. Turn on code shrinking and obfuscation (R8 on Android) for test builds too.
6. Keep the secret sauce out of the test if it does not need testing. A closed test proves the app runs for 14 days; it does not need every feature.
7. Pick Verified or Pro testers for anything sensitive. They have more to lose and a track record you can see.

Nothing here is legal advice. For high-stakes projects, have your own counsel review the agreement.