How can I find and fix my android app's security vulnerability?

Question

I have received this message from Google. We aren't using any TrustManager or etc. We are using okhttp and google publisher, and I don't know how can I detect this security vulnerability.

We found that your app contains security vulnerabilities, which can expose user information or damage a user’s device. This is a violation of Device and Network Abuse policy. Specifically, your app(s) are vulnerable to TrustManager. To address this issue, follow the steps in this Google Help Center article.

Affected Version(s): APK: 21

dependencies {
    implementation 'androidx.constraintlayout:constraintlayout:2.0.4'
    implementation "androidx.multidex:multidex:2.0.1"
    implementation 'com.google.android.material:material:1.2.1'

    implementation 'com.google.firebase:firebase-messaging:21.0.1'

    implementation 'com.facebook.android:facebook-android-sdk:8.2.0'

    implementation 'com.github.chrisbanes:PhotoView:2.1.3'
    implementation 'org.jsoup:jsoup:1.13.1'
    implementation 'com.android.billingclient:billing:3.0.2'
    annotationProcessor 'com.jakewharton:butterknife-compiler:10.2.3'
    implementation 'com.jakewharton:butterknife:10.2.3'

    implementation 'io.reactivex.rxjava3:rxjava:3.0.8'

    implementation 'com.google.code.gson:gson:2.8.6'

    implementation 'com.varunjohn1990.libraries:WhatsappMessengerView:2.1.0'

    implementation 'com.google.apis:google-api-services-androidpublisher:v3-rev20201125-1.31.0'
    implementation 'com.google.auth:google-auth-library-oauth2-http:0.22.2'

    implementation 'com.github.drawers:SpinnerDatePicker:2.0.1'
    implementation 'com.elyeproj.libraries:loaderviewlibrary:2.0.0'
    implementation 'link.fls:swipestack:0.3.0'

    implementation 'jp.wasabeef:picasso-transformations:2.4.0'
    // If you want to use the GPU Filters
    implementation 'jp.co.cyberagent.android:gpuimage:2.1.0'

    implementation 'com.squareup.picasso:picasso:2.71828'

    implementation 'com.github.HamidrezaAmz:AndroidImageSlider:v1.0.8'
    implementation 'com.eightbitlab:blurview:1.6.3'

    implementation 'pl.bclogic:pulsator4droid:1.0.3'

    implementation 'com.google.android.play:core:1.9.0'

    implementation project(':bottomnavbar')
    implementation project(':segmentcontrol')
    implementation project(':scrool')
}

\build.gradle: Error: commons-logging defines classes that conflict with classes now provided by Android. Solutions include finding newer versions or alternative libraries that don't have the same problem (for example, for httpclient use HttpUrlConnection or okhttp instead), or repackaging the library using something like jarjar. [Dupli catePlatformClasses]

\build.gradle: Error: httpclient defines classes that conflict with classes now provided by Android. Solutions include finding newer versions or alternative libraries that don't have the same problem (for example, for httpclient use HttpUrlConnection or okhttp instead), or repackaging the library using something like jarjar. [DuplicateP latformClasses]

This fixed those error:

implementation ('com.google.apis:google-api-services-androidpublisher:v3-rev20201125-1.31.0')  {
    exclude group: 'org.apache.httpcomponents'
}

implementation ('com.google.auth:google-auth-library-oauth2-http:0.22.2')  {
    exclude group: 'org.apache.httpcomponents'
}

    OkHttpService service = new OkHttpService();
    SubscriptionPurchase purchase = new AndroidPublisher.Builder(new NetHttpTransport(), JacksonFactory.getDefaultInstance(), 
            new HttpCredentialsAdapter(GoogleCredentials.fromStream(service.sendRequestInput(config.CREPATH + "credentials.json", null)).
            createScoped(AndroidPublisherScopes.ANDROIDPUBLISHER))).setApplicationName(String.valueOf(R.string.app_name)).
            build().purchases().subscriptions().
            get(BuildConfig.APPLICATION_ID, subscriptionID, token).execute();


<issue
    id="TrustAllX509TrustManager"
    severity="Warning"
    message="`checkServerTrusted` is empty, which could cause insecure network traffic due to trusting arbitrary TLS/SSL certificates presented by peers"
    category="Security"
    priority="6"
    summary="Insecure TLS/SSL trust manager"
    explanation="This check looks for X509TrustManager implementations whose `checkServerTrusted` or `checkClientTrusted` methods do nothing (thus trusting any certificate chain) which could result in insecure network traffic caused by trusting arbitrary TLS/SSL certificates presented by peers.">
    <location
        file="Project\com\google\api\client\util\SslUtils$1.class"/>
</issue>