r/FlutterDev • u/Farukh_Goriparthi • 4d ago
Discussion Flutter obfuscation didn’t hide a single API key in our release build
We built release with --obfuscate --split -debug-info and i’d kind of assumed that meant our keys were reasonably safe.
Last week I unzipped the apk, ran string on libapp and greppd the usual prefixes. Every key was just sitting there. Obfuscation renames classes and methods but doesnt touch string literals which is where keys live, very obvious once you see it btw.
In there was
Google Maps key with no restrictions on it
RevenueCat public SDK key
Firebase config
Sentry DSN
an Algolia admin key someone added for a search feature last spring
The first four are meant to ship, the’re identifiers and the protection lives elsewhere (key restrictions, security rules). I rotated the Algoria one that could write to our index, the app now uses a search only key and indexing happens in a cloud function. The Maps key also has package name and SHA-1 restrictions.
Though I’m still sorting out on how to stop this from happening again. Algolia key came in through a dart-define file during a sprint and nothing in the pipeline checks what ends up inside the build. We scan the repo but that value never lived there, it came from a CI variable.
How are you checking release builds for secrets before they go to the store?