3 ms·

Last Covid, I did the same reverse engineering our government's Covid app and found out that the API keys (public and private) were hardcoded in the source code

Last Covid, I did the same reverse engineering our government's Covid app and found out that the API keys (public and private) were hardcoded in the source code. Never got any response. Edit: Emphasized public and private keys

tiziano88 4y ago
Where else should API keys be, if they are needed by the app?
- ggm 4y ago
  Private key should be in the trust region and set up when you make the account
  - harvey9 4y ago
    I took the gpp to mean the publisher had leaked their private key by putting it in the app code when it should never have left their servers.
    - ggm 4y ago
      Also possible. Enough private keys in git repo to make this believable.