search

zetachang / react-native-dotenv

A Babel preset let you import application configs from .env file (zero runtime dependency)
MIT License
915 stars 68 forks source link

Is it a safe/secure way to store SECRET KEYS ? #61

Open Gorbus opened 5 years ago

Gorbus commented 5 years ago

Hi,

I am using Expo for an app without backend but where I need to use some API SECRET KEYS (such as google places, sendgrid, etc...)

Is this package a safe solution to store these keys ? Are they fully secured while app is in production ?

I am not sure I understand fully the scope of the package. Thanks for clarification.

jamonholmgren commented 5 years ago

Short answer: no, this isn't secure or safe.

Long answer: there isn't really a way at all. https://medium.com/poka-techblog/the-best-way-to-store-secrets-in-your-app-is-not-to-store-secrets-in-your-app-308a6807d3ed

klaaz0r commented 4 years ago

Your app is a client and a client should never store any secret