Your install rate drops a chunk one week, and only when you dig in do you see why: the user installed your APK, the phone's security app threw up a red "high risk" warning, and they left. Nobody files a bug for this. They just don't install. By the time you upload the package to VirusTotal, maybe three of fifty-odd engines flag it. Three, not fifty. Your build is almost certainly clean. It just looks like it isn't.

This is one of the most frustrating things about self-distribution. A listed app sits behind the store's own signing system and scan reputation, which vouch for it. Go self-hosted and that vouching disappears. The scanner looks at your package the way it looks at any unknown new face, and defaults to suspicion.

Why it gets flagged

Nine times in ten, the flag has nothing to do with whether the package is actually malicious.

Most often it's reputation. A scanner leans heavily on whether this package, or this signing key, has done anything bad before. You're a new app, a new signature, a new download source with no history, so the classifier hands you a low starting score. Take the same code, sign it with a freshly generated key, and the false-positive rate jumps.

Then there are permissions. Reading contacts, sending SMS, accessibility services, device admin, launching other apps in the background: none of these are crimes, but they're exactly what real malware reaches for, so they trip the heuristics. Use them and you inherit the suspicion.

Obfuscation works against you too. ProGuard and R8 scramble the code so the scanner can't tell what it's doing, and playing it safe it leans toward flagging. It's an ironic deadlock. You obfuscate to make reverse-engineering harder, and the obfuscation itself raises your false-positive rate.

In China there's a particularly nasty one: shared or rented enterprise certificates. What gets sold as "super signing" is really piggybacking on someone else's enterprise cert or a pooled device list. Those certificates have been reused across endless unknown packages, so their reputation is already garbage. Hang your build on one and you inherit its whole rap sheet.

Put plainly, when a scanner flags you, nine times in ten it's not because you're malicious. It's because you're unfamiliar. There's no shortcut to becoming familiar; it's earned over time, and the things that earn it are your signing key and your download source.

What actually helps

  • Keep your signature stable. Sign every version from day one with the same key; don't chop and change. Reputation accrues to the signing key, so frequent re-signing means starting from zero each time. This ties back to the code-signing article.
  • Don't touch shared certs. Rented enterprise certs and super signing are convenient, but the price is reputation spent by strangers, and Apple cracks down harder on enterprise-cert abuse every year, so what works today may get the whole cert revoked tomorrow. Signing your own key and building it up slowly is the steadier play.
  • Submit for whitelisting. The main domestic vendors all take appeals: Tencent's Habo, 360's software open platform, Threatbook. Upload a sample to dispute a false positive and, once approved, they update their databases. VirusTotal isn't a whitelist, but uploading lets the engines see your package sooner and start building reputation. Have patience. An appeal takes anywhere from a few days to a couple of weeks, and you'll basically re-file every major release, so fold it into your release process instead of waiting for users to send screenshots.
  • Trim permissions. Cut anything unused out of the manifest, especially the high-risk ones: SMS, contacts, accessibility. If a narrower API gets the job done, don't request the broad one. Fewer permissions, smaller heuristic surface.
  • Explain yourself on the download page. The most underrated fix. Rather than letting the user panic at a "high risk" prompt, spell it out on the install page: why this app needs this permission, why the phone is warning them, and where to tap to trust it after installing. A few honest lines recover a real share of people who'd otherwise bail halfway.

False positives don't have a cure, but they have a throttle. Stable signing, whitelisting appeals, trimmed permissions, and a download page that explains itself: get those solid and the flag rate drops visibly. Accept that it won't hit zero. Every major release you'll basically run the appeals again; treat it as a fixed step before launch, not something you scramble to fix after a user complains. The one piece of good news is that reputation only grows. The longer your package is out and the more people download it, the more familiar your signature and download source look to the scanners. The first year is the worst. After that it loosens up, year by year.