wtf is proguard-lint?

ProGuardLint is a Gradle plugin for Android developers that checks whether sensitive parts of an app were properly obfuscated before release, meaning their code was scrambled to make it harder to reverse engineer. It focuses on a common security mistake: certain packages, like payment or authentication code, ending up unobfuscated by accident and shipping to users in a readable form. Most tools that check obfuscation quality work by decompiling the finished app file, which can take several minutes and needs extra tooling. ProGuardLint takes a different approach. Android's own build tools, ProGuard and R8, already produce two files during a release build called mapping.txt and seeds.txt that record what got obfuscated and what was deliberately kept unobfuscated. ProGuardLint simply reads those files, which lets it run in under a quarter of a second with no decompiler and no extra setup. Developers configure a list of package names considered sensitive, called danger zones, and the plugin checks whether any class inside those packages was kept unobfuscated by the build's keep rules. If it finds a violation, it can fail the build automatically and produce a readable report, which is useful for catching the mistake before an app reaches the app store rather than after. The plugin runs as a normal Gradle task alongside a release build and also works inside GitHub Actions, where it can post a summary directly on a pull request. It supports recent versions of the Android Gradle Plugin, Gradle itself, and Kotlin. The project is released under the MIT license, so it can be freely used and modified, including in commercial projects.