EAS build secrets stay out of bundles when env profiles and eas.json split right

UpdatedSeptember 5, 2026

A secret that ships inside your JavaScript bundle is not a secret. In Expo production builds, the most common leak is not a hacked server — it is a service key baked into the bundle through a public environment variable, then published to a store listing that anyone can download and unpack.

This post lays out a practical split for EAS builds: public config that is safe to embed, server-side secrets that never enter the bundle, and the profile setup that keeps staging and production from cross-contaminating each other.

If you are catching up on the release lane, start with /blog/eas-update-rollback-plan — the rollback plan assumes your builds are reproducible, and reproducible builds start with clean environment separation.

This is an excerpt. Read the full post at otf-kit.dev/blog/eas-build-secrets-env-profiles-production — full-stack kits your AI coding agent can actually ship to production. Browse the kits →

#react-native #cross-platform #backend

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Retool and Appsmith fit internal tools; a SaaS dashboard kit owns the product repo

Two different jobs get collapsed into one shopping cart Retool and Appsmith are built to ship internal tools: admin panels, ops dashboards, and data-backed screens that sit on top of databases and API

Sep 10, 20261 min read

Retool and Appsmith fit internal tools; a SaaS dashboard kit owns the product repo

GitHub Actions triggers EAS builds when EXPO_TOKEN and non-interactive flags are set

Local builds must succeed before CI can be honest GitHub Actions cannot invent EAS credentials, bundle identifiers, or build profiles for you. Expo's own CI guide starts with a blunt prerequisite: run

Sep 10, 20261 min read

GitHub Actions triggers EAS builds when EXPO_TOKEN and non-interactive flags are set

Transactional email your AI-built app already owes users from day one

Your AI-built app has working signup, working sign-in, and working password reset. You tested all three yourself and watched each one succeed. What you never saw is the email each flow sends, because

Sep 10, 20261 min read

Transactional email your AI-built app already owes users from day one

Release health for AI-built apps: let every build carry its verdict

Your app launched, the first strangers are using it, and now the only question that matters is whether each new build makes things better or worse. Crash counts cannot answer that — a release with twi

Sep 10, 20261 min read

Release health for AI-built apps: let every build carry its verdict

Secure token storage in Expo stops leaking sessions attackers can replay

Storing an auth token in AsyncStorage feels harmless during development. The login works, the session persists across restarts, and nothing complains. Then your app ships, and that same token sits in

Sep 10, 20261 min read

Secure token storage in Expo stops leaking sessions attackers can replay

OTF — kits your AI coding agent can ship to production

548 posts

Engineering notes on shipping production apps with AI coding tools — Claude Code, Cursor, Codex, Lovable, Bolt — and the stack underneath: React Native, Expo, Next.js, Supabase. Honest takes on what works, what breaks, and the full-stack kits that get you to production faster. By OTF.

Command Palette

Comments

More from this blog