I am looking at security scans of an APK file for a client, and the scan flags that Android 7 (which appears to correspond to API 24) is targeted. However, when I look in their Manifest file, I am not seeing a target SDK called out at all. Is 24 the default, or something else? Is there another place to look for target API level? Android 7 is very outdated, and Google will not allow apps with a target SDK below 13 for existing apps or 14 for new apps on the play store. I also understand that MitM attacks became more significantly more difficult with the upgrade from Android 7 to Android 8.
I'd like to get confirmation for my client that Android 7/API 24 is indeed targeted by their app. Is it the default?
Edit: The application uses gradle. Is there somewhere to look in the gradle files for target API?
There is no such thing as a "default" api target one needs to be specified. If you have the project the target is specified in the apps build.gradle file