Client-side exposure is the risk that data sent to a user’s device can be inspected, extracted, or reused outside the developer’s control. In mobile apps, this often means API keys, tokens, configuration values, or business logic shipped inside an APK, JavaScript bundle, or other client package. Once the file is on the device, an attacker can unpack it, read resources, and search for sensitive material without breaking into the backend.
This matters because anything embedded in client code should be treated as recoverable, not secret. Exposed credentials can enable unauthorized API access, backend abuse, or further reconnaissance if they remain valid. Defenders reduce the risk by keeping secrets server-side, using short-lived tokens, limiting client privileges, and scanning build artifacts before release. Attackers use the same techniques in reverse: static analysis and automated secret scanning to mine large numbers of apps for reusable credentials.