@Aurimas yes, both of those. There's secrets that need to be used only during the build process, like keystores or google-services.json on Android, and then there's secrets that end up being embedded in a bundle to be used at runtime, like API keys and other identifiers. The latter are of course avoided altogether.