Phase 0: Intent Tell the user: "I will review your RevenueCat security posture on Android: verification mode, API keys, user identity, and server side access decisions." Phase 1: Discovery Confirm what RevenueCat already covers so you can focus on the real gaps. | Concern | Who handles it | How | |---|---|---| | Receipt validation against Google Play | RevenueCat backend | Runs before returns | | Purchase token reuse | RevenueCat backend | Tokens are deduplicated server side | | Fabricated purchase tokens | RevenueCat backend | Fails Google Play verification, no entitlement granted | | HTTPS…