How to keep your app's secrets, secret
summary
Claims that about 55% of apps contain hard‑coded secrets, ~30% use Firebase and ~5% of those expose data, drive concrete fixes: use the official Gradle secrets plugin to stop committing keys, run git-leaks then rewrite history with BFG or git‑filter‑repo, remove secrets entirely behind a backend proxy with short‑lived revocable tokens and Play device attestation via the Play Integrity API, and treat obfuscation (DexGuard or NDK plugins) as only a partial defense.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:02App secrets and why they matter
- 3:10Risks of exposed secrets
- 8:29Removing secrets from code
- 13:48Rewriting git history
- 19:26Secret-free codebase recipe
- 20:50Securing remaining secrets
- 27:51Architectural approach
- 35:14Near-perfect application recipe
- 35:57Managing API tokens securely
- 40:09Summary
- 41:38Q&A
related talks
41m[REDACTED]: How to keep your app's secrets, secret
39mAre your secrets secure - How mobile apps are leaking millions of credentials
53mAre your secrets secure? How mobile applications are leaking millions of credentials
48mRemoving Secrets To Make Your Mobile Apps More MASVS-Secure
47mSecuring Android Applications, The Right Way
32mKeep it Like a Secret: When Android Apps Contain Private Keys
36mEnhancing Mobile App Security
24mModern Android App Security: Protecting Code, Keys, and Data