  The ubiquity of smartphones, and their very broad capabilities and usage,
make the security of these devices tremendously important. Unfortunately,
despite all progress in security and privacy mechanisms, vulnerabilities
continue to proliferate. Research has shown that many vulnerabilities are due
to insecure programming practices. However, each study has often dealt with a
specific issue, making the results less actionable for practitioners. To
promote secure programming practices, we have reviewed related research, and
identified avoidable vulnerabilities in Android-run devices and the "security
code smells" that indicate their presence. In particular, we explain the
vulnerabilities, their corresponding smells, and we discuss how they could be
eliminated or mitigated during development. Moreover, we develop a lightweight
static analysis tool and discuss the extent to which it successfully detects
several vulnerabilities in about 46,000 apps hosted by the official Android
market.
