Exported BroadcastReceivers on Android 12+
Manifest merger failed on API 31 — three receivers lacked exported; one exported receiver wiped cache on any broadcast.
android:exported requirements, RECEIVER_NOT_EXPORTED, and replacing implicit CONNECTIVITY_CHANGE receivers.
The production story behind explicit exported flags
exported=true on internal-only receivers without permission protection. Teams usually discover the gap only after a finance reconcile, a security review, or a slow metric drift that nobody pages until customers notice. Exported BroadcastReceivers on Android 12+ is load-bearing once traffic, tenants, or compliance requirements grow past the pilot.
The pattern is predictable: demo-grade wiring ships in a sprint; production adds retries, partial failures, multi-tenant isolation, and humans who double-click submit. Explicit Exported Flags is how you convert that chaos into an invariant someone can operate.
Designing exported broadcastreceivers on android 12+ for real constraints
Name three boundaries on a whiteboard: ingress (who triggers work), enforcement (where invariants are checked), and evidence (what you log for audits). For explicit exported flags, enforcement must be synchronous on the critical path — advisory checks in notebooks are not controls.
Platform owns shared defaults; product owns domain configuration. Orphan ownership is how regressions return silently after launch.
Write a one-page decision record: what you rejected, what metrics gate rollback, and which environments may diverge. Link dashboards from the runbook header so on-call does not search Slack for URLs during an incident.
Implementation walkthrough
Ship the smallest production slice first: one tenant, one region, one workflow — with rollback documented before widening scope. Automate rotation, rebuilds, and reconciles so on-call never hand-edits explicit exported flags during an incident.
Integration tests should mirror production topology — single-region staging is not enough if users are global. For client apps, exercise offline, process death, and token rotation — not only office Wi-Fi happy paths.
# Operational hook — explicit exported flags
def apply_broadcast_receiver_exported(ctx):
validate_preconditions(ctx)
result = execute(ctx)
emit_metrics(result)
return result
Platform depth
Platform teams own defaults and libraries; product teams own domain config. Document interfaces where explicit exported flags gates handoffs to downstream owners. Review after every magnitude change in traffic or model swap — assumptions drift silently.
Failure modes worth rehearsing
- Missing idempotency when clients retry.
- Implicit defaults that differ between staging and production.
- Dashboards green while user-visible SLO burns.
- Credential or metadata rotation without overlap window.
- Schema or index change without blue-green validation.
Document for each: drop, retry, dead-letter, or fail-closed — and test under production-shaped load.
Metrics and alerts
Leading indicators: error rate on explicit exported flags, queue age, validation failure rate, stale read rate. Lagging indicators: incidents, audit findings, invoice disputes. Slice by tenant tier during rollout — global averages hide bad canaries.
Day-two operations
Runbooks fit one page: symptom, dashboard, mitigation, rollback. Assign an owner team; explicit exported flags regresses when orphaned. Pick one tier-1 workflow this week, put enforcement on the critical path, add one leading metric, and game-day the top failure mode above.
Production hardening
Pin versions affecting explicit exported flags. Progressive rollout: internal tenants → canary → full promote. Keep previous config hot-swappable one release.
Handoff and ownership
Exported BroadcastReceivers on Android 12+ touches multiple teams — name DRIs in the service catalog. New hires should rollback safely using only the runbook within week one.
Further reading
Operating explicit exported flags after scale events (review 1)
Traffic doublings, model swaps, and enterprise SSO enablement invalidate assumptions in the original design. Quarterly on-call reviews should update thresholds from recent incidents — not only the primary author's memory.
When exported broadcastreceivers on android 12+ touches billing, auth, or retrieval, schedule a cross-team review after every major launch. Platform, product, security, and finance should agree on what the leading metric is and who owns rollback.
Game days to run: dependency slow-down, duplicate webhook delivery, index swap rollback, IdP cert rotation dry-run. Measure time-to-mitigate, not only time-to-detect. When providers change streaming or auth semantics without a deploy on your side, error-class metrics should catch drift within hours.
Document one concrete lesson from each game day in the runbook header — future on-call should not rediscover the same failure mode.
Operating explicit exported flags after scale events (review 2)
Traffic doublings, model swaps, and enterprise SSO enablement invalidate assumptions in the original design. Quarterly on-call reviews should update thresholds from recent incidents — not only the primary author's memory.
When exported broadcastreceivers on android 12+ touches billing, auth, or retrieval, schedule a cross-team review after every major launch. Platform, product, security, and finance should agree on what the leading metric is and who owns rollback.
Game days to run: dependency slow-down, duplicate webhook delivery, index swap rollback, IdP cert rotation dry-run. Measure time-to-mitigate, not only time-to-detect. When providers change streaming or auth semantics without a deploy on your side, error-class metrics should catch drift within hours.
Document one concrete lesson from each game day in the runbook header — future on-call should not rediscover the same failure mode.
Operating explicit exported flags after scale events (review 3)
Traffic doublings, model swaps, and enterprise SSO enablement invalidate assumptions in the original design. Quarterly on-call reviews should update thresholds from recent incidents — not only the primary author's memory.
When exported broadcastreceivers on android 12+ touches billing, auth, or retrieval, schedule a cross-team review after every major launch. Platform, product, security, and finance should agree on what the leading metric is and who owns rollback.
Game days to run: dependency slow-down, duplicate webhook delivery, index swap rollback, IdP cert rotation dry-run. Measure time-to-mitigate, not only time-to-detect. When providers change streaming or auth semantics without a deploy on your side, error-class metrics should catch drift within hours.
Document one concrete lesson from each game day in the runbook header — future on-call should not rediscover the same failure mode.
Operating explicit exported flags after scale events (review 4)
Traffic doublings, model swaps, and enterprise SSO enablement invalidate assumptions in the original design. Quarterly on-call reviews should update thresholds from recent incidents — not only the primary author's memory.
When exported broadcastreceivers on android 12+ touches billing, auth, or retrieval, schedule a cross-team review after every major launch. Platform, product, security, and finance should agree on what the leading metric is and who owns rollback.
Game days to run: dependency slow-down, duplicate webhook delivery, index swap rollback, IdP cert rotation dry-run. Measure time-to-mitigate, not only time-to-detect. When providers change streaming or auth semantics without a deploy on your side, error-class metrics should catch drift within hours.
Document one concrete lesson from each game day in the runbook header — future on-call should not rediscover the same failure mode.
Operating explicit exported flags after scale events (review 5)
Traffic doublings, model swaps, and enterprise SSO enablement invalidate assumptions in the original design. Quarterly on-call reviews should update thresholds from recent incidents — not only the primary author's memory.
When exported broadcastreceivers on android 12+ touches billing, auth, or retrieval, schedule a cross-team review after every major launch. Platform, product, security, and finance should agree on what the leading metric is and who owns rollback.
Game days to run: dependency slow-down, duplicate webhook delivery, index swap rollback, IdP cert rotation dry-run. Measure time-to-mitigate, not only time-to-detect. When providers change streaming or auth semantics without a deploy on your side, error-class metrics should catch drift within hours.
Document one concrete lesson from each game day in the runbook header — future on-call should not rediscover the same failure mode.
Frequently asked questions
When should teams prioritize Exported BroadcastReceivers on Android 12+?
When targeting API 31+ with manifest receivers.
What is the most common mistake with explicit exported flags?
exported=true on internal-only receivers without permission protection.
How do we know Exported BroadcastReceivers on Android 12+ is working?
Define a leading metric for explicit exported flags (error rate, stale read rate, recall, verification failures) and a lagging metric (incidents, invoice variance, audit findings). Review both in weekly ops, not only after escalations.
Hiring a senior Android / Flutter engineer?
I architect and ship production mobile software — Kotlin, Jetpack Compose, Flutter — for robotics, EV infrastructure, fintech, and real-time systems. Open to remote roles in Europe and the US.
Get in touch →