New to android development. When we distribute the .apk file, can the receiver extract the google-services.json and use our database or authentication database.
I looked I have apk file, Is it possible to get android studio project from apk? and Is google-services.json confidential? and Is it possible to decompile an Android .apk file? but don't directly relate
I tried to extract an apk of mine which has google-services.json file and I couldn't find the google-services.json file in extracted folder .
Edit : Here is more info I found
The google-services plugin has two main functions:
1 - Process the google-services.json file and produce Android resources that can be used in your application's code. See Adding the JSON File more information.
2 - Add dependencies for basic libraries required for the services you have enabled. This step requires that the apply plugin: 'com.google.gms.google-services' line be at the bottom of your app/build.gradle file so that no dependency collisions are introduced. You can see the result of this step by running ./gradlew :app:dependencies.
This means that the google-services.json file will be converted to android resources by google-services plugin during build process .
You can find how google-services.json works over here
can the receiver extract the google-services.json and use our database or authentication database.
Even if the receiver extracts credentials from apk , he cannot access database as the SHA-1 will be different .
