I've copied all files containing "danger" to both release and debug java folders (solution learnt from http://stackoverflow.com/questions/18782368/android-gradle-buildtypes-duplicate-class), and removed every trace of any "danger" related code in the release apk. This way, we make sure nobody can exploit that unused variable in production mode, so that if Android fails to protect our app (people have been able to introduce code into signed apks, so it's not impossible), we make it difficult to bypass the SSL certificate verification. You can call me paranoid if you want ;)