Here is what our secrets.properties file would look: apiKey.staging=aRwAAAW51bS.Īnd how the adle file would look after changes: Properties secretProperties = new Properties() Next, we should update the adle file by removing the old values and adding values from the file. The first step in hiding secrets would be to create a separate file named something like secrets.properties, and fill it with all the existing credentials and licenses. Removing Secrets from the adle File and Repository

We want to remove secrets from the build to improve application adle file and our repository to prevent unauthorized access. In case we have staging and production flavors, here is what it could look like:īuildConfigField STRING, API_KEY, ‘aRwAAAW51bS…’īuildConfigField STRING, API_KEY, ‘aRwCCCdE23S.’ Usually, secrets, like credentials, are used inside the adle file because they are environment-specific features. Some of the secrets in Android projects are: API keys, KeyStore credentials, licenses for the 3rd party SDK, etc. This article explains how to keep secrets safe in Android projects. So, if you want to keep secrets safe, the goal is to eliminate the potential threats as much as possible.

Malicious actors exploit those mistakes to gain certain advantages. There’s no way to be 100% secure in software development because software is developed by humans, and humans tend to make mistakes.

Buildconfigfield