Secrets Gradle Plugin: Avoid Git Leaks Without Claiming APK Secrecy

Use the plugin for the right purpose

The official plugin guidance describes reading local configuration and exposing values to the Android build. This can reduce accidental Git commits and make environment-specific setup clearer.

A key included in a manifest, resource or generated constant can still be extracted from the distributed application. Do not put privileged backend credentials into the client simply because they came from an ignored properties file.

Separate configuration classes

Avoid naming every configuration value “secret”; the actual authority it grants determines the risk.

Make missing values fail clearly

Provide safe development defaults only where they cannot accidentally point a release at the wrong service. For required release configuration, fail the build with a clear message rather than silently inserting an empty key or a test project identifier.

Do not print full values in Gradle logs when diagnosing a missing property.

Restrict and test client keys

Use the provider's supported restrictions, such as package/signing identity and allowed APIs where applicable. Test the actual Play-signed release identity, not only the local debug certificate. A valid key with the wrong restrictions can work in one distribution channel and fail in another.

Inspect the final package

APKLint can help identify key-like values and manifest configuration. Its scanner cannot establish whether a provider's server-side restrictions are correct. Follow Android security guidance, review the cloud-side configuration and treat a leaked privileged credential as a rotation incident, not merely a string to remove from the next APK.