Original Summary

Hi guys, A client of mine recently hired an offshore agency on Upwork to build an Android app. At first glance, everything looked great. The user interface was sleek and the app worked well. But when we checked the final release build, we found that the developers had put their master Stripe secret key and AWS access keys right into the app package. Anyone who downloaded the app from the Google Play Store could have decompiled it in less than a minute and used those keys to drain their API budget or even access customer accounts. The founder had no technical knowledge, and therefore didn't realize it until someone pointed it out. This realization showed me just how widespread the problem is among non-technical founders who hire freelancers or agencies; you end up paying thousands for an app but still have no simple method of checking whether the underlying code is safe. I am currently developing a simple "Pre-Release Security & Key Leak Audit" tool which allows you to drag and drop the .apk file that your developer has provided, and it then produces a one-page Pass/Fail Security Report within thirty seconds, indicating whether any live secrets or private keys had been left inside the code before you give your final approval for payment. I’d love your feedback: How does a founder who is not technical currently check the quality or security of applications developed by freelancers? Would obtaining an automated one-page Pass/Fail security report give you a sense of peace of mind before you release an app or before you release escrow funds? If somebody wants me to carry out a free manual security check on their present app build, just leave a comment or send me a direct message.   submitted by   /u/Remote-Dig-202 [link]   [comments]

  • 情报分类：商业与市场研究
  • 分类依据：内容涉及商业、投资或市场动态
  • 信息来源：Reddit · SaaS
  • 发布时间：2026/10/15 16:40:46