electron packaged into asar target windows , config json with api key setting, is safe?

505 views Asked by At

If an app is packaged with asar and the electron app uses a settings json file that I created that includes api key info... is this is a terrible idea related to security? How hard is it for someone to view this json file in plain-text?

1

There are 1 answers

1
OJ Kwon On

How hard is it for someone to view this json file in plain-text?

Asar is nothing more than a simple archive, pretty much anyone can extract and read file inside.

https://github.com/electron/asar#asar---electron-archive : it works like tar that concatenates all files together without compression