CODEWITHSUNDEEP
androidgradlereverse-engineering
Alysson Cirilo
Alysson Cirilo

Reputation: 21

Are the repository credentials defined in gradle stored somewhere in the generated APK?

Suppose we have the following repository definition in gradle

repositories {
    maven {
        url 's3://my-top-secret-repo/releases'
        credentials(AwsCredentials) {
            accessKey 'MY_TOP_SECRET_ACCESS_KEY'
            secretKey 'MY_TOP_SECRET_SECRET_KEY'
        }
    }
}

My question is, is there some way to someone reverse engineer the generated android APK and discover MY_TOP_SECRET_ACCESS_KEY and MY_TOP_SECRET_SECRET_KEY?

Upvotes: 2

Views: 106

Answers (1)

ChristianB
ChristianB

Reputation: 2690

Gradle build configurations are not stored in an apk. The build tool (in this case Gradle) uses this configuration to fetch the dependencies and build the apk including the .class files from those dependencies.

But you should pay attention when you store passwords in Java/Kotlin files as strings. These can be reversed engineered for sure.

Upvotes: 1

Related Questions