Scan of 156,000 iOS apps found widespread hardcoded secrets

What happened

A large-scale Cybernews scan found secret keys embedded directly in the code of most tested iOS apps. Apple's App Review does not currently check apps for this type of backend exposure.

Being listed in the App Store does not guarantee that an app's cloud services are securely configured.

What was found

The scan surfaced more than 815,000 keys, access to billions of cloud files and nearly 20 million exposed Firebase user records, including payment and authentication credentials.

Data at risk

• API keys
• Cloud storage
• Firebase records
• Payment keys
• Auth tokens
• User credentials

What you should do

1. 1Use extra caution with lesser-known apps handling sensitive data.
2. 2Use different credentials across different services.
3. 3Watch for affected-app lists and vendor fix statements.
4. 4Developers should remove secrets from shipped application code.