Expo inlines EXPO_PUBLIC_ variables and app config extra fields into the JavaScript bundle, and EAS Update publishes that bundle to every device. EAS secret environment variables are safe only while they stay in build tooling. Proxy private API calls and keep tokens in SecureStore.
Inlined into each build and OTA update.
Safe for build steps only, never read into app code.
Store with expo-secure-store.
Use them for signing or build hooks, and never expose them to the runtime bundle.
It is backed by Keychain on iOS and Keystore on Android.
Constants.expoConfig values are bundled and downloadable from published updates.
EAS Update bundles are delivered to every installed app and can be inspected.
Store upstream keys in the RealComposer vault and give the Expo app only a client token, so rotating a secret never requires a new build or OTA update.
Only if they never reach app code. Anything read at runtime through EXPO_PUBLIC_ or app config is public.
React Native APK and IPA bundles can be disassembled with standard decompilers, exposing hardcoded environment variables. Use RealComposer to store your Stripe Secret Key server-side on Cloudflare Workers and return only safe, slimmed responses to your mobile app.
EXPO_PUBLIC_ variables and app config extra fields are inlined into every Expo build and EAS Update bundle, so an Anthropic key placed there is public. Call a RealComposer pipeline instead: it injects ANTHROPIC_API_KEY as the x-api-key header at the edge and returns just the reply text.
The Supabase service_role key bypasses row level security, so it must never appear in an Expo app or OTA update. Keep the anon key in the app for normal queries and send privileged reads to a RealComposer pipeline that holds service_role in the vault and returns filtered fields.
Credential leakage is the unintended exposure of secrets such as API keys, tokens, and passwords. Common sources include JavaScript bundles, decompiled mobile apps, public Git repositories, browser network logs, and low-code platform configurations visible to users.
Secret RotationSecret rotation is the practice of periodically replacing API keys, passwords, and other credentials with new values and revoking the old ones. Rotation limits how long a leaked secret remains useful and is required by many security standards.
Client Token (Scoped Bearer Auth)A Client Token is a scoped, revocable authentication credential designed for frontend web and mobile applications. It grants permission to invoke specific edge API pipelines while enforcing allowed-origin domains and rate limits, safely abstracting sensitive upstream API secrets.