The Technology Behind My Protected Android App
My Android App Builder takes care of the complicated Android stuff automatically.
You enter your website and app details, and the builder checks the website to decide the best way to build it. If it finds a service worker, it uses Bubblewrap and TWA. If there isn't one, it can use a WebView fallback instead.
Your fine-grained GitHub token allows the builder to securely start the build inside your private GitHub repository, while repository secrets protect important signing information such as your keystore and passwords.
Your sensitive values—such as the keystore password, key password and other signing credentials—are stored as GitHub Actions Secrets in the private repository.
When your builder starts a GitHub Actions build:
Builder → starts private workflow → GitHub temporarily supplies the required secrets → workflow uses them to sign/build the app → APK/AAB is produced.
For example, the workflow can reference something like:
secrets.KEYSTORE_PASSWORD
GitHub substitutes the real value while the workflow is running, without putting the password directly into the workflow file.
After that, the finished APK/AAB doesn't need your GitHub token or your plain-text signing passwords inside it. They were build-time credentials, not something the app needs to carry around.
My personal Safeguard added
Alongside what everyone can use, there is a hidden feature for myself. And I'm going to explain how it works.
Essentially what it does is stops website visitors viewing my website, but allows users opening the website through my protected Play Store app.
From the app ID I enter
Because it detects my account, I can then use the website guard+ checker generator (in one)
It uses the App ID to calculate a unique, repeatable protection key. The same App ID produces the same key whenever I update that app
I then put the generated website guard + checker (in one) onto my website
The app I build then carries the matching protection key when it launches the website .✅
Have you given it a go? I'd love to know ✨
ReplyDelete