How safe are the keys/values? Can someone extract them?

[renatop7]

My question is more related to android I guess...
Can someone reverse engineer the .apk and extract my .env variables values?

[nik27]

Yes. You should store API keys and other sensitive info on your backend and fetch it after user is authenticated.

In the readme of react-native-config it's explicitly mentioned:

Keep in mind this module doesn't obfuscate or encrypt secrets for packaging, so do not store sensitive keys in .env. It's basically impossible to prevent users from reverse engineering mobile app secrets, so design your app (and APIs) with that in mind.

This is also mentioned in React Native docs.
This article might also be helpful.

[renatop7]

Thanks for the inputs :)