An APK is a ZIP anyone can open
Rename any .apk to .zip and double-click it: your site is sitting in assets/web/, file for file. That is not a flaw of ZIP-based apps — every Android app's resources are readable this way — but it changes what "harmless leftovers" means. A .git folder in an APK is your full commit history, including every file you ever deleted. A .env is whatever API keys were in it. A source map is your original, unminified source code with comments.
The other reason is size. node_modules alone can be hundreds of megabytes; a macOS-made ZIP carries a __MACOSX shadow copy of the resource forks of every file. None of it runs; all of it counts against the upload limit.
What each rule removes
| Rule | Default | Why |
|---|---|---|
| OS litter | On | Created by Finder and Explorer, never referenced by a page. |
| Secrets & keys | On | Private keys, keystores and environment files must never ship. If one did, treat the secret as leaked and rotate it. |
| Version control | On | The full history of the project, including deleted files. |
| Dependencies | On | A built site has already bundled what it needs from these folders. |
| Source maps | On | Debugger data mapping minified code back to source. Useful on your machine, a liability in an APK. |
| Editor & tooling | On | Settings for VS Code, JetBrains, GitHub Actions, linters and formatters. |
| Project manifests | Off | Harmless but useless at runtime. Off by default because a hand-written site might fetch a .json file with one of these names. |
| Design & source files | Off | Photoshop, Figma, TypeScript and Sass sources. Off by default so a site that serves .ts files as data is not broken. |
| Repository docs | Off | READMEs and changelogs. Licence files are always kept — many open-source licences require them to travel with the code. |
Keeping the ZIP clean at the source
On macOS, zip -r site.zip . -x "*.DS_Store" -x "__MACOSX/*" -x "*.map" from inside the site folder produces a clean archive directly. On Windows, the built-in "Compressed (zipped) folder" does not add litter of its own, but it happily includes Thumbs.db and anything hidden. The most reliable habit is to zip the build output folder only, never the project root.