They need to remove those Gradle options because the hardening plugin takes over the functions those settings previously controlled. Leaving both in place creates duplicated or conflicting build instructions, which can make the configuration harder to reason about and increase the chance of incorrect output. Clean ownership of build behaviour is the safer operating model.
Why DexGuard changes the Gradle build model
DexGuard is not just an add-on filter, it becomes the component that owns the hardening behaviour previously controlled by ProGuard-related Gradle options. Once that handoff happens, the old settings are no longer a clean source of truth. Keeping both often leaves the build file expressing the same intent twice, which makes the configuration harder to interpret and easier to misapply.
The practical issue is control ownership. Build options that were valid before enabling DexGuard can become redundant, ignored, or semantically overlapping after the plugin is introduced. That creates uncertainty about which tool is actually shaping the output, especially when teams are reviewing shrink, obfuscation, or optimisation behaviour across multiple modules or build variants.
When the same behaviour is configured in two places, the build may still succeed, but the resulting APK or AAB can become less predictable to reason about. The safer pattern is to let one mechanism define the hardening rules and remove older Gradle directives that no longer have a distinct role. That keeps the build pipeline easier to audit and reduces configuration drift.
What can go wrong if the old options stay behind
Leaving obsolete ProGuard-related options in place does not usually create a dramatic failure mode on its own. The bigger problem is ambiguity. Teams can end up believing a setting is active when DexGuard is actually controlling that area, or they may spend time troubleshooting build output that is being influenced by overlapping directives rather than a single deliberate configuration.
Failure mechanism: duplicated or conflicting build instructions create an unclear precedence model, so the build system may apply one set of rules while the team still maintains another. Over time that increases the chance of incorrect assumptions during maintenance, upgrades, or incident response for a broken release.
Impact: the immediate impact is reduced clarity and a higher chance of misconfiguration; the broader impact is slower debugging, more fragile build governance, and a greater risk that the compiled artifact does not match the team’s intended hardening posture. In practice, that matters most when changes are made quickly or by teams that do not own the entire build chain end to end.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 4 — Secure Configuration of Enterprise Assets and Software | Build-file cleanup is configuration control for software behaviour. |
| Recommendation — Remove obsolete Gradle options and keep one authoritative hardening configuration. | ||
| OWASP Agentic AI Top 10 | A7 — Supply Chain and Dependency Risks | Build hardening depends on trustworthy tooling and unambiguous build instructions. |
| A5 — Identity and Access | Duplicated build ownership can obscure who or what actually controls artifact generation. | |
| Recommendation — Ensure the build pipeline has a single trusted owner for hardening behaviour. Assign clear authority for build transformations and eliminate conflicting directives. | ||
| NIST CSF 2.0 | PR.IP-1 — Configuration Management | The question is about managing build configuration consistently after a tooling change. |
| PR.DS-6 — Integrity | Consistent hardening rules help preserve the intended integrity of the produced artifact. | |
| Recommendation — Update the build baseline so deprecated ProGuard settings are removed after migration. Verify the final artifact reflects the intended DexGuard-controlled build policy. | ||
Practitioner Guidance
What to verify: confirm which build tool owns shrink, obfuscation, and optimisation after DexGuard is enabled, then remove any Gradle options that only repeat that ownership. Treat the remaining configuration as the authoritative build contract, not a historical record of prior ProGuard usage.
Common mistake: teams often keep legacy settings “just in case” after migration. That is usually harmless only until someone later reads the file as if every option is still meaningful. The cleaner standard is to delete controls that are no longer operationally authoritative rather than leaving them as documentation by accident.
Practitioner takeaway: the goal is not to preserve every prior setting, but to preserve one unambiguous source of build behaviour. If DexGuard now owns the function, the old ProGuard-related Gradle options should be removed so future changes are easier to validate and less likely to conflict.
Related resources from NHI Mgmt Group
- What should teams do in the first 72 hours after RC4-related authentication failures start?
- How should teams remove secrets from Kafka and related workloads?
- What should security teams verify after enabling stronger mesh defaults?
- What do security teams get wrong about rotating credentials after an AI-related incident?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
