Is it bad practice to include sensitive information in iOS source code comments?

user_1152868 0
Viewed 102

Forgive me, I thought this should be an easy question to Google, but it's turned out to be surprisingly difficult.

I am working on obfuscating secret keys in my iOS application. I'd like to add a comment above the obfuscated value that adds clarity to a developer reading the source. But, I don't want this comment to essentially "un-do" the obfuscation.

So, the question ultimately is, are comments stripped from the release build? Are they readable by tools that can inspect source?

So, looking for general security practices in terms of comments on iOS.

swift security ios
2 Answers

Comments are only included in the source code. The are absolutely stripped from ANY build, release or debug.

If you are looking to provide a framework to other developers, and want to hide certain things like API keys from consumers of your framework then you should look at the comments you provide in your framework, but that is not relevant to app builds that users run. There is no trace of source code or comments in those.

(Also see Rob's answer about thinks like API secrets and keys.)

user_2051850

Duncan is correct (+1) that code comments are stripped from the build. But, the “what can I include in comments” is not just a question of scenarios where you are distributing the code (e.g., open-source frameworks). As a general rule, all keys, secrets, and the like, should be excluded from source control, even if you are currently the only developer (as eventually, other devs may be included in the project). In other words, one should not include app secrets in code (that is under source control), even if it is in the comments.

Code comments should provide enough information for devs to understand/maintain the code, but never commit secrets to source control.

user_12718260
Related