ハードコードされたキーとシークレットの発見と検証

$ app8 egrep -r 'AIza[0-9A-Za-z\\-_]{35}' . 
Binary file ./resources.arsc correspondent
Binary file ./app.apk correspondent
Binary file ./classes.dex correspondent                                
./assets/google-services-desktop.json:          "current_key": "AIzaSy....................."

$ curl -s -X POST --header "Authorization: key=AIzaS........." --header "Content-Type:application/json" 'https://fcm.googleapis.com/fcm/send' -d '{"registration_ids":["1"]}'
<HTML>
<HEAD>
<TITLE>INVALID_KEY_TYPE</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>INVALID_KEY_TYPE</H1>
<H2>Error 401</H2>
</BODY>
</HTML>

$ curl https://graph.facebook.com/oauth/access_token\?client_id\=51XXXX\&client_secret\=0cbd4XXXXX\&redirect_uri\=\&grant_type\=client_credentials
{"access_token":"5181XXXXXXXXXXXXXX","token_type":"bearer"}% 

$ curl "https://graph.facebook.com/v8.0/51XXXXXXXX/permissions?access_token=51XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
{"data":[{"permission":"email","status":"live"},{"permission":"pages_show_list","status":"live"},{"permission":"pages_messaging","status":"live"},{"permission":"groups_show_list","status":"live"},{"permission":"pages_read_engagement","status":"live"},{"permission":"public_profile","status":"live"}]}%   

Unlike how API keys are typically used, API keys for Firebase services are not used to control access to backend resources; 
that can only be done with Firebase Security Rules. 
Usually, you need to fastidiously guard API keys (for example, by using a vault service or setting the keys as environment variables); 
however, API keys for Firebase services are ok to include in code or checked-in config files.

You have a mobile app. Do not embed access keys with the app, even in encrypted storage. 
Instead, use Amazon Cognito to manage user identities in your app. This service lets you authenticate users using Login with Amazon, Facebook, Google, or any OpenID Connect (OIDC)–compatible identity provider. 
You can then use the Amazon Cognito credentials provider to manage credentials that your app uses to make requests to AWS. For more information, see Using the Amazon Cognito Credentials Provider on the AWS Mobile Blog. 

Your secret API key can be used to make any API call on behalf of your account, such as creating charges or performing refunds. 
Treat your secret API key as you would any other password. Grant access only to those who need it. 
Ensure it is kept out of any version control system you may be using. 
Control access to your key using a password manager or secrets management service.

In live mode, new secret keys are only visible the first time you access them. 
After that, the Dashboard redacts the API key. When the key is revealed, you can leave a note on the Dashboard describing the location on your own systems where you’ve copied it. 
If you lose your secret key, you can’t recover it from the Dashboard and must roll the key or create another one.