Why is storing secrets in android gradle recommended if it can be decompiled like hardcoded string?

121 Views Asked by At

I'm trying to understand the benefits of storing secrets in Gradle properties when they're still exposed in decompiled code. For example, let's say I store a secret key in gradle.properties:

API_KEY="Some Secret String"

Then, I referenced this key in build.gradle app defaultConfig section

buildConfigField("String", "GRADLE_KEY_PASSWORD", GRADLE_KEY_PASSWORD)

And I access it on my java class

String hiddenKey=BuildConfig.API_KEY;

but when I decompile the app with jadx, the secret key is exposed as a hardcoded string like this:

this.f1416x = "Some Secret String";

What is the benefit of doing this other than version control?

0

There are 0 best solutions below