I have created a little app using Firebase magic for android. I just wornder if someone were to reverse engineer my app, can they find the google-services.json file? Because if so, they will have all of the API keys and the rest of the data which placing in attackers app would give all the access to the database modification etc.

  • yes, they can, don't allow clients to access you secrets, proxy outside interaction behind a server you control so that you can authenticate, validate, and protect API secrets. – dandavis Apr 2 '17 at 19:03
  • So how come google doesnt even warn about keeping the json in the project before addin on google play?? Does SHA do any good for protecting the project? – StuckBetweenTrees Apr 2 '17 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.