{"id":20085420,"url":"https://github.com/klaxit/hidden-secrets-gradle-plugin","last_synced_at":"2025-04-05T22:07:29.868Z","repository":{"id":40248641,"uuid":"279260293","full_name":"klaxit/hidden-secrets-gradle-plugin","owner":"klaxit","description":"🔒 Deeply hide secrets on Android ","archived":false,"fork":false,"pushed_at":"2024-03-21T20:42:20.000Z","size":157,"stargazers_count":407,"open_issues_count":12,"forks_count":42,"subscribers_count":9,"default_branch":"master","last_synced_at":"2025-03-29T21:05:25.682Z","etag":null,"topics":["android","gradle","hide","key","plugin","secret"],"latest_commit_sha":null,"homepage":"","language":"Kotlin","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/klaxit.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-07-13T09:40:19.000Z","updated_at":"2025-03-28T13:08:16.000Z","dependencies_parsed_at":"2024-11-13T16:06:41.235Z","dependency_job_id":null,"html_url":"https://github.com/klaxit/hidden-secrets-gradle-plugin","commit_stats":null,"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/klaxit%2Fhidden-secrets-gradle-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/klaxit%2Fhidden-secrets-gradle-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/klaxit%2Fhidden-secrets-gradle-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/klaxit%2Fhidden-secrets-gradle-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/klaxit","download_url":"https://codeload.github.com/klaxit/hidden-secrets-gradle-plugin/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247406089,"owners_count":20933803,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","gradle","hide","key","plugin","secret"],"created_at":"2024-11-13T15:55:53.418Z","updated_at":"2025-04-05T22:07:29.836Z","avatar_url":"https://github.com/klaxit.png","language":"Kotlin","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![travis ci status](https://travis-ci.org/klaxit/hidden-secrets-gradle-plugin.svg?branch=master)](https://travis-ci.com/github/klaxit/hidden-secrets-gradle-plugin/branches)\n[![MIT license](https://img.shields.io/github/license/klaxit/hidden-secrets-gradle-plugin)](https://github.com/klaxit/hidden-secrets-gradle-plugin/blob/master/LICENSE)\n\n# Gradle plugin to deeply hide secrets on Android\n\nThis plugin allows any Android developer to deeply hide secrets in its project. It is an OSS equivalent of what [DexGuard](https://www.guardsquare.com/en/products/dexguard) can offer to prevent **credentials harvesting**.\n\nIt uses a combination of obfuscation techniques to do so :\n- secret is obfuscated using the reversible XOR operator, so it never appears in plain sight,\n- obfuscated secret is stored in a NDK binary as an hexadecimal array, so it is really hard to spot / put together from a disassembly,\n- the obfuscating string is not persisted in the binary to force runtime evaluation (ie : prevent the compiler from disclosing the secret by optimizing the de-obfuscation logic),\n- optionally, anyone can provide its own encoding / decoding algorithm when using the plugin to add a security layer.\n\nThis plugin is **used in production** at [Klaxit - Covoiturage quotidien](https://play.google.com/store/apps/details?id=com.wayzup.wayzupapp). Our engineering team at Klaxit will provide its best effort to maintain this project.\n\n⚠️ Nothing on the client-side is unbreakable. So generally speaking, **keeping a secret in a mobile package is not a smart idea**. But when you absolutely need to, this is the best method we have found to hide it.\n\n## Compatibility\nThis gradle plugin can be used with any Android project in Java or Kotlin.\n\n# 1 - Install the plugin\n## Using the plugins DSL\nIn your Module level `build.gradle`:\n\n```gradle\nplugins {\n    id \"com.klaxit.hiddensecrets\" version \"0.2.1\"\n}\n```\nℹ️ If your project sync triggers the issue `Could not find com.android.tools.build:gradle:X.Y.Z`, please use the legacy plugin application below.\n## Using legacy plugin application\nAdd these lines at the beginning of your Module level `build.gradle`:\n\n```gradle\nbuildscript {\n    repositories {\n        google()\n        maven {\n            url \"https://plugins.gradle.org/m2/\"\n        }\n    }\n    dependencies {\n        classpath \"com.klaxit.hiddensecrets:HiddenSecretsPlugin:0.2.1\"\n    }\n}\n\napply plugin: 'com.klaxit.hiddensecrets'\n```\n\nFor more details about the installation check the [plugin's page](https://plugins.gradle.org/plugin/com.klaxit.hiddensecrets) on gradle.org.\n\n# 2 - Hide secret key in your project\n\nObfuscate and hide your key in your project :\n```shell\n./gradlew hideSecret -Pkey=yourKeyToObfuscate [-PkeyName=YourSecretKeyName] [-Ppackage=com.your.package]\n```\nThe parameter `keyName` is optional, by default the key name is randomly generated.\nThe parameter `package` is optional, by default the `applicationId` of your project will be used.\n\n# 3 - Get your secret key in your app\nEnable C++ files compilation by adding this lines in the Module level `build.gradle` :\n```gradle\nandroid {\n\n    ...\n\n    // Enable NDK build\n    externalNativeBuild {\n        cmake {\n            path \"src/main/cpp/CMakeLists.txt\"\n        }\n    }\n}\n```\n\n👏 Now you can get your secret key from Java/Kotlin code by calling :\n```kotlin\n// Kotlin\nval key = Secrets().getYourSecretKeyName(packageName)\n```\n```Java\n// Java\nfinal String key = new Secrets().getYourSecretKeyName(getPackageName());\n```\n\n# 4 - (Optional) Improve your key security\nYou can improve the security of your keys by using your own custom encoding / decoding algorithm. The keys will be persisted in C++, additionally encoded using your custom algorithm. The decoding algorithm will also be compiled. So an attacker will also have to reverse-engineer it from compiled C++ to find your keys.\n\nAs an example, we will use a [rot13 algorithm](https://en.wikipedia.org/wiki/ROT13) to encode / decode our key. Of course, don't use rot13 in your own project, it won't provide any additional security. Find your own \"secret\" encoding/decoding algorithm!\n\nAfter a rot13 encoding your key `yourKeyToObfuscate` becomes `lbheXrlGbBoshfpngr`.\nAdd it in your app :\n```shell\n./gradlew hideSecret -Pkey=lbheXrlGbBoshfpngr -PkeyName=YourSecretKeyName\n```\n\nThen in `secrets.cpp` you need to add your own decoding code in `customDecode` method:\n```cpp\nvoid customDecode(char *str) {\n    int c = 13;\n    int l = strlen(str);\n    const char *alpha[2] = { \"abcdefghijklmnopqrstuvwxyz\", \"ABCDEFGHIJKLMNOPQRSTUVWXYZ\"};\n    int i;\n    for (i = 0; i \u003c l; i++)\n    {\n        if (!isalpha(str[i]))\n            continue;\n        if (isupper(str[i]))\n            str[i] = alpha[1][((int)(tolower(str[i]) - 'a') + c) % 26];\n        else\n            str[i] = alpha[0][((int)(tolower(str[i]) - 'a') + c) % 26];\n    }\n}\n```\n\nThis method is automatically called and will revert the rot13 applied on your key when you will call :\n```kotlin\nSecrets().getYourSecretKeyName(packageName)\n```\n\n# Going further\n## Generate secrets from properties file\nYou can generate secrets from properties file as well.\n\n### Use case\nIf you are using CI system to provide secrets, that are not hard-coded into the repository itself. It will re-generate those secrets in the app and build it.\n\nThis is useful if you want to split production keys from repository itself, thus increasing security in your project repository.\n\n### Setting up\n1. Create a new properties file in root project directory.\n\n``` shell\ncredentials.properties\n```\n\n2. Fill in wanted secrets. For ex.:\n\n``` java-properties\nkeyName1=yourKeyToObfuscate1\nkeyName2=yourKeyToObfuscate2\n```\n\n3. Run\n\n``` shell\n./gradlew hideSecretFromPropertiesFile -PpropertiesFileName=credentials.properties\n```\n\nIt will regenerate all secret files in the project and update all secrets from the properties file.\n\n# Other available commands\n\n## Copy files\nCopy required files to your project :\n```shell\n./gradlew copyCpp\n./gradlew copyKotlin [-Ppackage=your.package.name]\n```\n\n## Obfuscate\nCreate an obfuscated key and display it :\n```shell\n./gradlew obfuscate -Pkey=yourKeyToObfuscate [-Ppackage=com.your.package]\n```\nThis command can be useful if you modify your app's package name based on `buildTypes` configuration. With this command you can get the obfuscated key for a different package name and manually integrate it in another function in `secrets.cpp`.\n\n# Development\n\nPull Requests are very welcome!\n\nTo get started, checkout the code and run `./gradlew build` to create the `.jar` file in `/build/libs/`.\n\nBefore opening a PR :\n- make sure that you have tested your code carefully\n- `./gradlew test` must succeed\n- `./gradlew detekt` must succeed to avoid any style issue\n\n# Authors\n\nSee the list of [contributors](https://github.com/klaxit/hidden-secrets-gradle-plugin/contributors) who participated in this project.\n\n# License\n\nPlease see [LICENSE](https://github.com/klaxit/hidden-secrets-gradle-plugin/blob/master/LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fklaxit%2Fhidden-secrets-gradle-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fklaxit%2Fhidden-secrets-gradle-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fklaxit%2Fhidden-secrets-gradle-plugin/lists"}