Security of react-native-dotenv

[Golberg-Mark]

Hey! I have a question about your react-native-dotenv repository. I'm trying to find a way for storing sensitive api keys in my expo app. In expo v49 and higher they can store public variables in .env file with prefix EXPO_PUBLIC_. But with this approach they paste these env variables in your code and it's not secure. So I tried to find solution for this problem and found your repository. I wanna ask you: does your lib paste this variables into the code as EXPO_PUBLIC_ or no?

[goatandsheep]

are you using managed expo? if so, most secure thing to do is to enter your keys into the expo dashboard directly. Then you can use expo environment variables or react-native-dotenv for using those variables. As you know, it is not a good idea to be keeping compiled apps with keys baked in git. However, if these are sensitive 3rd party API keys, you might want to consider using your back-end as a proxy for the API instead. If this is your API, you should consider using a token authentication system for your API.