In this lesson, you will learn how to identify and prevent sensitive information—like API keys or secret tokens—from being accidentally bundled into your compiled mobile application.
The Danger of "Hardcoded" Secrets
When you build your React Native app, the bundler (Metro) packs your JavaScript code and environment variables into the final native binary. If you mistakenly import a file containing a sensitive key, that key becomes part of the application's permanent storage. Anyone who decompiles your app—an easy task for a malicious actor—can extract those secrets.
While we use EXPO_PUBLIC variables for client-side configuration, these are explicitly meant for non-sensitive data. The problem arises when developers accidentally include server-side secrets or private keys in the same configuration files.
Reviewing Your Build Logs
The best way to catch these leaks before they reach the App Store or Play Store is to inspect your build logs during the development cycle. When you run a build command (like npx expo run:android or npx expo run:ios), the terminal generates a verbose output of everything being processed.
Watch for warnings or unexpected file inclusions during the "bundling" phase. If you see your build tool referencing a .env file that contains SECRET_KEY=... or DATABASE_PASSWORD=..., that is a red flag.
A Quick Audit Check
If you are worried about what’s currently in your bundle, you can search your project for common patterns that shouldn't be there. Imagine you accidentally included a file named secrets.js:
// AVOID THIS: Never export raw secrets for the client to bundle
export const PRIVATE_API_KEY = "sk_live_51Mz00abc123";
If this file is imported anywhere in your src directory, the build log will eventually include a reference to this file or the variable itself. If you grep your project for keywords like sk_live or password and find hits in files that get bundled, you are at risk.
Key Takeaway: Never rely on your app code to store secrets; always assume that any data present in your build logs or source code will be readable by anyone who downloads your app.