Cloudinary iOS SDK configuration suggests to hardcode your api_secret
in your iOS app's source code.
Isn't that a security vulnerability since string literals can be extracted from the app binary, e.g., by using the strings
command?
Neither the Facebook SDK for iOS nor the AWS Mobile SDK for iOS asks you to hardcode your API secret into your iOS app's source code. To authenticate client requests, the Facebook SDK for iOS seems to use some sort of signing algorithm and the AWS Mobile SDK for iOS uses pre-signed URLs & Amazon Cognito Identity.