It is an obvious security vulnerability to have my API keys out in the open as such when initially developing my app. Parse is setup this way because it’s easy for development and learning I assume.
I’m going on the assumption that accepting only HTTPS will be enough to protect the keys in transit. If this is not the case please advise.
The main issue I’m having is how to protect the keys in the source code against decompilers.
If I were to encrypt the keys, and decrypt for API requests, then re-encrypt the keys again when not in use, would this be sufficient or could someone malicious still reverse engineer the app to get keys and launch attacks against my users’ data?
I’ll take a Flutter Parse answer but I’d be happy with any general idea, starting point or answer.
