# Secrets embedded in client apps

Hardcoded tokens, keys or basic-auth credentials in APK/IPA bundles, binaries, or runtime method arguments

_Area: Mobile app security. Seen in 4 disclosed reports; 2 confirmed bounties: $500 and $38,250; latest 2022-02-24. Updated 2026-10-23._

## How it works
A secret that grants server-side authority is shipped inside the client. The broken assumption is that the app bundle or binary is a safe place to keep a credential, or that obfuscation hides it. Anything the app can read, an attacker with the device can read: static strings in the APK/IPA, Base64 blobs in bundles, or plaintext arguments passed to SDK methods at runtime. The secret's privilege class (app token, FCM server key, AWS key, basic-auth pair) sets the blast radius, not where it was found.

## Where it shows up
- Base64-encoded action strings in mobile bundles; decode and look for `appID|secret` shapes [E1](https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-instagram-app-access-token.md)
- Authorization headers on upload requests whose token is longer or uses a different charset than the normal client-token pattern `[0-9]|[a-z0-9]*` [E1](https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-instagram-app-access-token.md)
- Decompiled APK resources matching key regexes (`AIzaSy`, `AAAA:`) with variable names like `server_key`, `notification_server_key` [E2](https://bugbountylibrary.com/r/blog%3Aabss-me-posts-fcm-takeover.md)
- HTTP basic-auth credentials in the binary pointing at dev/staging hosts [E3](https://bugbountylibrary.com/r/h1%3A246995.md)
- Obfuscated AWS client/secret keys passed in plaintext to SDK init methods at runtime [E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps.md)

## How to review
The invariant: no credential that grants authority beyond the single user's own session may exist in the client. For each candidate secret, identify what it authenticates to and whether that service accepts it as send/admin authority. Use the variable name and surrounding code to infer the key's privilege class before treating it as sensitive [E2](https://bugbountylibrary.com/r/blog%3Aabss-me-posts-fcm-takeover.md). For obfuscated values, hook the SDK init/setup methods and inspect arguments rather than reversing the obfuscation [E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps.md). Distinguish app tokens from client tokens by the length and charset of the secret segment [E1](https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-instagram-app-access-token.md).

## Variants seen
- First-party app access token in a Bloks bundle action string [E1](https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-instagram-app-access-token.md)
- FCM legacy server keys hardcoded in APK granting broadcast push [E2](https://bugbountylibrary.com/r/blog%3Aabss-me-posts-fcm-takeover.md)
- Basic-auth credentials for a dev admin panel [E3](https://bugbountylibrary.com/r/h1%3A246995.md)
- Obfuscated AWS keys recoverable at runtime via hooking [E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps.md)

## Why fixes fail
Obfuscation alone did not remove the secret; it still reached `initKey:` in plaintext [E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps.md). Retiring the main host did not kill dev/staging clones reusing the same credentials [E3](https://bugbountylibrary.com/r/h1%3A246995.md).

## Impact and severity
Ranged from admin-level Graph API access [E1](https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-instagram-app-access-token.md) and broadcast push to all users [E2](https://bugbountylibrary.com/r/blog%3Aabss-me-posts-fcm-takeover.md), to admin panel access [E3](https://bugbountylibrary.com/r/h1%3A246995.md) and S3 credential exposure [E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps.md). Severity rises with the privilege class of the leaked secret and the number of users or environments it covers.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-instagram-app-access-token.md
- E2: https://bugbountylibrary.com/r/blog%3Aabss-me-posts-fcm-takeover.md
- E3: https://bugbountylibrary.com/r/h1%3A246995.md
- E4: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-low-hanging-apples-hunting-credentials-and-secrets-in-ios-apps.md