1

When releasing the first build for my project, I found out that the APK file APPNAME-release.apk includes my source code.
The whole tree of my project is located in assets folder of the apk file.
I couldn't find in the documentation of tns build any option to exclude the source code from the bundle.

1 Answers1

0

Of course your source code is required, without that the app will be void. Even if you build an app with Java for Android, your source code is still there. Decompiling the APK will give you all your Java source code.

So it's recommended to Obfuscate your source code always. With NativeScript, we have Webpack and UglifyJS by default, passing --bundle --env.uglify will make it hard to read. You are free to use any third party JS obfuscation by modifying your webpack.config.js

Manoj
  • 21,753
  • 3
  • 20
  • 41
  • This the worst news I had since 2018 ! –  Jan 02 '19 at 12:36
  • Every client side application (web & mobile apps) carries source code to the client machine. Only server side applications are exceptions where your code runs on host and only the output is carried to client. – Manoj Jan 02 '19 at 13:47
  • @Manoj Java source are not in the apk, contrary to class files naturally. In another hand Mobile apps are not all in client/server architecture. – elsadek Jan 02 '19 at 17:17
  • As I mentioned, it will be available upon simple reverse engineering (decompile). APK is nothing but a kind of zip file, assets (that includes JS) will be visible upon extraction. – Manoj Jan 02 '19 at 17:20