{"id":19645856,"url":"https://github.com/approov/android-hide-secrets","last_synced_at":"2025-08-03T10:14:04.156Z","repository":{"id":96185473,"uuid":"170027723","full_name":"approov/android-hide-secrets","owner":"approov","description":"An exercise to research and explore the best ways to hide a secret in the code of a mobile app. Article: https://blog.approov.io/how-to-extract-an-api-key-from-a-mobile-app-with-static-binary-analysis","archived":false,"fork":false,"pushed_at":"2019-02-22T15:02:13.000Z","size":1010,"stargazers_count":23,"open_issues_count":0,"forks_count":4,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-04-28T15:39:22.180Z","etag":null,"topics":["android","api-key","api-keys","approov","approov-demo","java","jni","jni-android","mobile","mobile-app","mobile-development","secrets"],"latest_commit_sha":null,"homepage":"https://approov.io","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/approov.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-02-10T21:10:59.000Z","updated_at":"2024-07-16T04:25:07.000Z","dependencies_parsed_at":"2023-03-23T08:48:10.177Z","dependency_job_id":null,"html_url":"https://github.com/approov/android-hide-secrets","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/approov/android-hide-secrets","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fandroid-hide-secrets","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fandroid-hide-secrets/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fandroid-hide-secrets/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fandroid-hide-secrets/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/approov","download_url":"https://codeload.github.com/approov/android-hide-secrets/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fandroid-hide-secrets/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":268527627,"owners_count":24264706,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-03T02:00:12.545Z","response_time":2577,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","api-key","api-keys","approov","approov-demo","java","jni","jni-android","mobile","mobile-app","mobile-development","secrets"],"created_at":"2024-11-11T14:35:39.984Z","updated_at":"2025-08-03T10:14:04.108Z","avatar_url":"https://github.com/approov.png","language":"Java","readme":"# ANDROID HIDE SECRETS\n\nA quick demo to show several ways of hiding secrets in a mobile app, like in:\n\n* source code\n* manifest file\n* gradle file\n* JNI/NDK\n\n\n## SETUP\n\nTo set the API key for `GRADLE_ENV_API_KEY`:\n\n```bash\n$ export GRADLE_ENV_API_KEY=$(echo \"api-key-for-gradle-file-from-env\" | openssl dgst -binary -sha256 | openssl enc -base64)\n$ echo $GRADLE_ENV_API_KEY\nsrqGFqMm23R6A7YJbAEmKRuSQ6TWnLq3YNtAWbEoSuE=\n```\n\nTo set the API key for `JNI_API_KEY`:\n\n```bash\n$  cp -v app/src/main/cpp/api_key.h.example app/src/main/cpp/api_key.h\n'app/src/main/cpp/api_key.h.example' -\u003e 'app/src/main/cpp/api_key.h'\n```\n\nNow edit the file `app/src/main/cpp/api_key.h` and look for the palce holder\n`ANDROID_HIDE_SECRETS_API_KEY_H` and replace its dummy value\n`place-the-api-key-here` with your desired API key, maybe like:\n\n```bash\necho \"api-key-for-the-jni-file\" | openssl dgst -binary -sha256 | openssl enc -base64\nyDbx5R+a6zJ3H76iU9YB9U0GY6DjZ4FiWFb8vCMCdLg=\n```\n\n## RUN\n\nJust start your Android Studio and build and run this project as usual for any\nother mobile app.\n\nThe app is a dummy one that only shows in the main screen all API keys hidden in\nthe code, just to prove that we can retrieve them.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Fandroid-hide-secrets","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fapproov%2Fandroid-hide-secrets","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Fandroid-hide-secrets/lists"}