I am working on an android application and the company request is to be able to potentially have a user edit the API URL the app uses to be able to work with different test environments.
This immediately threw up a red flag for me as this might lead an attacker putting in some bad URL (if they knew how to enable the ability to change the API URL) and do something bad to the device.
I have no security background so I dont know if this is of any concern but I feel like this can be abused some how whether it be a device exploit or other.
I tried pushing back and saying its not a good idea but they seem fixated on having it editable and I have nothing to back me up as proof that this is a bad idea.
Should I be concerned about having going down this route?