# Protect Secrets In The Build (Android + iOS)

> Learn a practical way to handle mobile secrets, on both Android and iOS.

- URL: https://dantech.academy/en/courses/kotlin-accelerator/engineer-builder/05-testing-security-release/lesson-04-protect-secrets-at-build-time
- Course: [Mobile Action Pro](https://dantech.academy/en/courses/kotlin-accelerator.md)
- Module: Testing, Security, and Release
- Duration: 5 min
- Difficulty: intermediate
- Access: Enrolled students
- Tiếng Việt: https://dantech.academy/courses/kotlin-accelerator/engineer-builder/05-testing-security-release/lesson-04-protect-secrets-at-build-time.md

## Objectives

- Classify values by trust boundary: authority, client configuration, local input, shipped, flag
- Trace the build route from local.properties (BuildConfig) and Config.xcconfig (Info.plist) to AppBuildConfig and SecretManager
- Explain why the Supabase publishable key is allowed in the app and RLS is what protects the data

## In this lesson

1. Lesson Goal
2. Specific Objectives
3. Part 1: Classify By Trust Boundary Instead Of Filename
4. Part 2: The Path On Android
5. Part 3: The Path On iOS
6. Part 4: Two Paths, One Meeting Point
7. Part 5: The Publishable Key May Be Exposed Because RLS Protects The Data
8. Part 6: The Gate For The iOS Build
9. Code Reading Path
10. Code Smells
11. References
12. Key Points

## Study with an AI agent

The full lesson is for students of this course. Students open the lesson on the web and press **Markdown** to copy all of it, then paste it into Claude, ChatGPT, Cursor or whichever agent you use. Faster: mint a token at `/profile/ai-agents` and your agent reads lessons over MCP.

- [Join the course](https://dantech.academy/en/kotlin-accelerator/checkout)

---

- Previous lesson: [Shrink And Protect The Android Release Build](https://dantech.academy/en/courses/kotlin-accelerator/engineer-builder/05-testing-security-release/lesson-03-shrink-and-guard-release-build.md)
- Next lesson: [CI For KMP](https://dantech.academy/en/courses/kotlin-accelerator/engineer-builder/05-testing-security-release/lesson-06-ci-for-kmp.md)