# Kotlin Android Conventions

- Separate presentation, domain, and data concerns even in smaller apps.
- Validate Intent extras and deep-link input before use.
- Keep navigation definitions explicit and test transitions that expose authenticated or privileged screens.
- Treat local persistence, WebView usage, and exported components as security-sensitive boundaries.