Safe app testing guide
Beta apps can carry more risk because they are still in development. Use this guide to separate legitimate testing from attempts to steal data or gain dangerous access.
If any part fails, stop—even when the publisher looks credible or the build has passed a platform review step.
Reasons to stop
- They send an APK, IPA, installer or shortened URL instead of an official Google Play/TestFlight link.
- They ask for a password, OTP, recovery code, seed phrase, card number, PIN or a real-money transfer.
- They request Accessibility, Device Admin, VPN, SMS, contacts, microphone or screen sharing without a task-specific reason.
- They pressure you to act now, move off BetaRoast, or avoid questions about the developer and collected data.
Before you install
- Confirm the URL is exactly play.google.com or testflight.apple.com, with no lookalike suffix.
- Match the app and developer to the Roast, and read every required task first.
- Use a test account, sample data and a spare device when sensitive or financial features are involved.
- Review permissions before accepting. Deny and question anything unrelated to the feature under test.
If you suspect a scam
Do not continue, enter data, transfer money or approve more permissions.
Record the Roast, URL and time; capture the message or permission screen while hiding your secrets.
Revoke granted permissions, uninstall the app and change any password you entered into it.
Send details through BetaRoast contact and report the app to Google Play or Apple where it was installed.
What BetaRoast does
Restricts new test links to Google Play/TestFlight, keeps build access for participants, warns before joining and opening a build, and accepts reports for suspicious accounts or Roasts.
What we cannot guarantee
BetaRoast does not inspect source code or guarantee an app is 100% safe. Store distribution and platform protections reduce risk but do not replace tester judgment.
Official references
Policies and protections can change; check the platform's current guidance directly.
Never include passwords or OTPs in a report. Send only necessary details and redact personal information from evidence.