react-native-dotenv icon indicating copy to clipboard operation
react-native-dotenv copied to clipboard

Is it a safe/secure way to store SECRET KEYS ?

Open Gorbus opened this issue 5 years ago • 2 comments

Hi,

I am using Expo for an app without backend but where I need to use some API SECRET KEYS (such as google places, sendgrid, etc...)

Is this package a safe solution to store these keys ? Are they fully secured while app is in production ?

I am not sure I understand fully the scope of the package. Thanks for clarification.

Gorbus avatar May 30 '19 06:05 Gorbus

Short answer: no, this isn't secure or safe.

Long answer: there isn't really a way at all. https://medium.com/poka-techblog/the-best-way-to-store-secrets-in-your-app-is-not-to-store-secrets-in-your-app-308a6807d3ed

jamonholmgren avatar Aug 02 '19 18:08 jamonholmgren

Your app is a client and a client should never store any secret

klaaz0r avatar Feb 03 '20 18:02 klaaz0r