Google Maps keys
Vault Android (package + SHA-1) and iOS (bundle ID) Maps keys. No AIza… values in JavaScript, AndroidManifest, or Info.plist as the source of truth.
App Security · AppDefender.dev
KeysDefender
Dynamic delivery of SDK keys, API secrets, and license material.
Super Admin vaults Client SDK secrets (MoEngage, Firebase, Juspay, Google Maps, analytics, and payment SDKs) with envelope encryption. The app receives a signed KP1 token. The KMS/HSM master key never leaves the server. Native KeysDefender unwraps with AES-256-GCM into Keystore / Keychain only after AppDefender ALLOW. React Native never receives the AES key. A token cannot override BLOCK.
Envelope encryption + KMS/HSM
KP1 protected tokens
Native-only unwrap (no keys in JS)
Maps · MoEngage · Juspay · Firebase
Rotation and revocation
Release denied after BLOCK
Isolated Sandbox and Production vaults
KeysDefender
What KeysDefender secures
Google Maps, MoEngage, Juspay, Firebase, analytics, and payment SDK keys unwrap natively after ALLOW. React Native never sees the AES key.
MoEngage & analytics
MoEngage, Firebase, and analytics app keys unwrap natively after ALLOW. React Native gets a handle — never the AES material.
Payments & money movement
Juspay and payment SDK secrets stay vaulted. KeysDefender releases them only when the launch gate is ALLOW; BLOCK never funds a compromised handset.
Push & third-party SDKs
Push, auth, and other Client SDK licenses follow the same KP1 path. One vault policy per Sandbox or Production environment.
Rotation & revocation
Super Admin rotates or revokes a key without a Client binary rebuild. Stolen tokens on a FAIL device still cannot unwrap.
No keys in JS
AES-256-GCM into Keystore / Keychain only. Embedding ciphertext with the decryptor in the binary is not KeysDefender.
What it does
KeysDefender on the launch path
KeysDefender is how Client apps ship Maps, payments, analytics, MoEngage, and push SDKs without parking those secrets in JavaScript. Super Admin vaults the material with envelope encryption. The KMS or HSM master key never leaves the server.
The app receives a signed KP1 token. Native KeysDefender unwraps with AES-256-GCM into Android Keystore or iOS Keychain only after the launch score is ALLOW. React Native never receives the AES key. Release is denied after BLOCK.
Rotation and revocation are operator actions on that Client’s isolated catalog. A stolen access token on a compromised handset does not unwrap Maps, MoEngage, or Juspay keys. Sandbox prefixes stay separate from Production.
What it scores
Signals this module is built for
- Envelope encryption with KMS / HSM master keys
- Signed KP1 tokens — not raw secrets on the wire
- Native-only unwrap into Keystore / Keychain
- No AES key on the React Native bridge
- Google Maps, MoEngage, Firebase, Juspay, analytics keys
- Rotation and revocation per environment
- Release denied when the launch score is BLOCK
How it runs
Detect, decide, enforce
Vault
Super Admin stores Client SDK secrets for Sandbox or Production — Maps, MoEngage, Juspay, Firebase, and more. Environments never share a vault.
Gate
AppDefender scores the device. ALLOW is required before native unwrap. BLOCK never releases a key.
Unwrap
AES-256-GCM into Keystore or Keychain. JS SDKs get a handle, not the material.
Operators
Who owns the control
Super Admin
Owns the vault, rotation, and which environment may release keys (Maps, MoEngage, payments, analytics).
Client Admin
Requests rotation. Cannot read the master key. Sees deny events in ThreatDesk.
Other App Security modules
Read the product page, not a copy here
All modules