Hardcoded secrets are API keys, passwords, tokens or cloud credentials left inside the shipped app. Because the app is a file anyone can download and unpack, a secret in the binary or resources can be pulled out in minutes with free tools.
The fix is to move anything privileged to a backend and ship only the minimum the app needs. A leaked server-grade key can affect every user at once, so detection before release matters.
Related terms
Software Bill of Materials (SBOM)Reverse Engineering (Mobile)Static Application Security Testing (SAST)Mobexa tests the exact Android or iOS build you ship and maps every finding to the OWASP Mobile Top 10 and MASVS.
Start Free Trial