--- title: "[REDACTED] — How to keep your mobile app’s secrets, a secret!" url: https://daily.dev/posts/redacted-how-to-keep-your-mobile-app-s-secrets-a-secret--605z53tt1 source_url: https://proandroiddev.com/redacted-how-to-keep-your-mobile-apps-secrets-a-secret-c65765e22a31 type: article source: "ProAndroidDev" published: 2026-08-21T14:12:12.680Z updated: 2026-08-21T14:35:15.370Z tags: ["security", "android", "git", "secrets-management"] reading_time: 13 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # [REDACTED] — How to keep your mobile app’s secrets, a secret! **[ProAndroidDev](https://daily.dev/sources/pand)** · 13 min read · 0 upvotes · 0 comments ## Summary A practical guide to preventing mobile app secrets like API keys from leaking, covering four steps: scanning your codebase and git history for secrets using tools like gitleaks or the newer betterleaks, rewriting git history with BFG Repo Cleaner or git-filter-repo to purge them, restricting API keys via provider consoles (e.g. Google Cloud Console), and ultimately moving secrets off the client entirely via a backend proxy. It cites research showing over 55% of Android apps and 68% of top iOS apps have leaked secrets, and notes newer LLM-based tools can now outperform traditional secret-scanning methods used by attackers, raising the stakes further. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I remove secrets that were accidentally committed to a git repository's history, not just the latest commit? Removing a secret from the latest commit is not enough because it still exists in git history; you need to rewrite history using a dedicated tool. BFG Repo Cleaner and git-filter-repo both accept a 'passwords' file listing secret strings and replace them with placeholders throughout history, though git's own filter-branch command is discouraged for being slow and error-prone. The process can take hours on large repos and forces all teammates to re-pull the rewritten history. _Developers cleaning up leaked secrets can find tool comparisons and follow-up guides on daily.dev._ ### What tool can I use to scan a git repository for hardcoded secrets like API keys and tokens? Gitleaks is an open-source CLI tool that scans a local git repo for common leaked secret patterns such as JWT tokens, AWS keys, and Google Cloud API credentials, and supports custom patterns. Its authors have shifted focus to a newer project called betterleaks, which offers better performance and quality-of-life improvements, run via a command like 'betterleaks git /path/to/repo -v --git-workers=16'. _Track shifts like this between secret-scanning tools by following mobile security topics on daily.dev._ ### Why is it not enough to just remove hardcoded API keys from my app's build config using something like Gradle BuildConfig? Injecting secrets via Gradle and BuildConfig at compile time keeps them out of source control, but they still end up baked into the compiled app binary and remain trivially accessible through decompilation. The more secure approach for published apps is proxying third-party API calls through your own backend, which stores secrets server-side and allows rotation without app downtime, while client-side restriction and injection methods only reduce, not eliminate, the attack surface. _Weighing client-side secret injection against backend proxying gets easier with security deep dives on daily.dev._ ## Similar posts on daily.dev - [Securing Secrets in Android: From API Keys to Production-Grade Defense](https://daily.dev/posts/securing-secrets-in-android-from-api-keys-to-production-grade-defense-jxwjjpdsh) · ProAndroidDev · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#android](https://daily.dev/tags/android), [#git](https://daily.dev/tags/git), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/redacted-how-to-keep-your-mobile-app-s-secrets-a-secret--605z53tt1)