The most dangerous security control is the one that stopped working without telling anyone. Google gave Android teams a textbook case.
Its deprecation timeline is final: "The SafetyNet Attestation API was deprecated in 2022 and fully turned down in January 2025." The same page documents what the call does now: it "always invokes the on failure listener with an ApiException and a status code of 7 (NETWORK_ERROR)." Google's final notice ruled out extensions entirely.
Whether that was an outage or nothing depends on one line of error handling written years ago. If the app blocked users on error, the team found out in January 2025. If the app let users through on error, which is the common choice because genuine network errors are common, then the attestation layer has been a no-op for more than a year. No crash, no alert, no red dashboard.
The Governance Lesson
Every security control needs an owner who can answer one question on demand: what does this control do when its dependency fails? Fail-open is sometimes the right business call. It is never the right unexamined default, and deprecated platform APIs are exactly where unexamined defaults hide.
What Replaces It, and What Not to Repeat
The successor is Google's Play Integrity API, and Google makes a strong claim for it: "apps using Play integrity features see 80% lower unauthorized usage on average compared to other apps" (Google, November 2025). Two design choices decide whether an organisation gets that result:
- Decide on the server. Google's setup guide is explicit: "Never decrypt tokens or expose keys within your client app." A verdict checked on the phone is checked where the attacker lives.
- Respond in tiers. Google recommends "a series of related responses such as Allow, Allow with limits, Allow with limits after CAPTCHA completion, and Deny." A single yes-or-no gate turns a fraud control into a customer-support problem.
The Signal Changed Meaning Under Existing Policies
Teams that migrated early should re-read their rules. In December 2024 Google moved device verdicts onto hardware-backed signals, with every integration transitioned in May 2025. On Android 13 and higher the strongest device verdict now "requires MEETS_DEVICE_INTEGRITY and security updates in the last year" (verdicts reference). A policy that demands it everywhere now excludes genuine customers whose phone makers stopped shipping patches. That is a product decision disguised as a security setting.
Plan for the Operational Limits
The default quota is "10,000 total requests" per day per Cloud project, and increases apply to both token generation and server-side decryption. A consumer app that checks integrity on every screen will hit it on its first busy day. Request on protected actions, and file for more quota before launch.
The executive checklist is short: confirm no SafetyNet call remains, confirm every integrity decision is made server-side, and confirm the policy has more than two outcomes.
-Rocky
#PlayIntegrity #AndroidSecurity #FraudPrevention #EngineeringDreams #StrategiaX
Originally published on ANDROID-ARCHITECT, the Android engineering blog of Strategia-X.