Rule Definition
When sharing data between two apps that you control or own, use signature-based permissions. These permissions don't require user confirmation and instead check that the apps accessing the data are signed using the same signing key. Therefore, these permissions offer a more streamlined, secure user experience.

Remediation
Do not use or android:protectionLevel="normal"

Violation Code Sample

<manifest xmlns:android="http://schemas.android.com/apk/res/android" 
    package="com.example.myapp"> 
    <permission android:name="my_custom_permission_name" 
                android:protectionLevel="normal" />

Fixed Code Sample

<manifest xmlns:android="http://schemas.android.com/apk/res/android" 
    package="com.example.myapp"> 
    <permission android:name="my_custom_permission_name" 
                android:protectionLevel="signature" />

https://developer.android.com/topic/security/best-practices https://developer.android.com/guide/topics/manifest/permission-element