Once an Android app for the startup I was working on had a suspiciously large apk size. One of our engineers dug in and realized that our packaging script copied the .git directory in with the static files.

All it took to see the source was to cd into the unzipped apk directory and do a "git reset --hard ."