Are the repository credentials defined in gradle stored somewhere in the generated APK?

user_14903544 0
Viewed 47

Suppose we have the following repository definition in gradle

repositories {
    maven {
        url 's3://my-top-secret-repo/releases'
        credentials(AwsCredentials) {
            accessKey 'MY_TOP_SECRET_ACCESS_KEY'
            secretKey 'MY_TOP_SECRET_SECRET_KEY'
        }
    }
}

My question is, is there some way to someone reverse engineer the generated android APK and discover MY_TOP_SECRET_ACCESS_KEY and MY_TOP_SECRET_SECRET_KEY?

gradle reverse-engineering android
1 Answers

Gradle build configurations are not stored in an apk. The build tool (in this case Gradle) uses this configuration to fetch the dependencies and build the apk including the .class files from those dependencies.

But you should pay attention when you store passwords in Java/Kotlin files as strings. These can be reversed engineered for sure.

user_147943800
Related