Build-Time Secrets

Instructions

Build-time secrets (signing keys, store API credentials, Fastlane match passphrases, Sentry auth tokens) are the ones that most often end up committed by accident. Harden the pipeline, not the developer.

1. What's a Build-Time Secret

Android: upload keystore, key password, key alias password, Play Developer API JSON, Firebase service account.
iOS: Apple Developer API key (AuthKey_*.p8), App Store Connect issuer ID, fastlane match passphrase, certificates.
Cross-cutting: Sentry auth token, npm / Maven publish token, release webhook URLs with embedded tokens.

None of these belong in the repo — including in /android, /ios, /fastlane, or encrypted-but-plaintext-in-CI files.