Claude's Android app hides a debug menu behind one flag

A reverse-engineering writeup on Claude's Android app found a SharedPreferences key called is_ant, set the moment the app checks whether the signed-in account's email ends in @anthropic.com. Flip that flag and a hidden settings menu opens up.

Inside: a jank overlay built on JankStats and FrameMetrics for watching frame drops live, an Age Signal override for testing age-gated behavior, GrowthBook feature-flag overrides, and a network simulation panel that injects latency or forces requests to fail outright. There's also an API endpoint selector, letting the app point at Production, Staging, Localhost, or a custom backend. Staging isn't wide open. It sits behind Cloudflare Access.

None of this is a vulnerability by itself. Shipping debug tooling and feature-flag overrides in a production binary is standard practice at any company running a mobile app at scale. Engineers need to reproduce jank on a real device, test bad network conditions without a proxy rig, and swap backends without a separate build. The detail worth sitting with is where the line sits: a client-side string comparison on an email domain, in the same binary every user downloads.

If you ship a mobile app, anything gated by a check the client performs on its own is a check a sufficiently curious user can flip. The staging endpoint sitting behind Cloudflare Access is the real security boundary here, not the is_ant flag. If your own app has a similar internal menu, the question isn't whether someone can find the flag. It's whether anything reachable behind it assumes only your own engineers will ever get there.