[REDACTED]: How to keep your app's secrets, secret
summary
Claim: roughly 55% of mobile apps have hard‑coded secrets; about 30% use Firebase and ~5% of those expose data; ~0.5% leak AWS keys. Practical fixes shown: run git‑leaks as a CI GitHub Action, rewrite history with git‑filter‑repo or BFG, migrate runtime keys to the Android secrets Gradle plugin, or remove keys from clients entirely by routing third‑party calls through a proxy with Play Integrity / Firebase App Check, rate limiting and key rotation. Obfuscation (DexGuard, hidden‑secrets, byte‑mask) helps but is not foolproof.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:12App secrets and why they matter
- 9:11Never store secrets in code
- 13:22Detect secrets with GitLeaks
- 16:10Rewrite git history to remove secrets
- 23:11Securing baked-in secrets
- 25:40Obfuscate secrets with tools
- 31:56Remove secrets with a proxy
- 39:57Summary
related talks
50mHow to keep your app's secrets, secret
39mAre your secrets secure - How mobile apps are leaking millions of credentials
53mAre your secrets secure? How mobile applications are leaking millions of credentials
48mRemoving Secrets To Make Your Mobile Apps More MASVS-Secure
24mModern Android App Security: Protecting Code, Keys, and Data
47mSecuring Android Applications, The Right Way
45mTen Secrets to Secure Mobile Applications
36mEnhancing Mobile App Security