How we protected FCM tokens in PDP Mobile
Recently, data leaks and supply-chain attacks have been in the spotlight, so we didn’t leave FCM tokens “as is.” In PDP Mobile, we introduced symmetric encryption for tokens before storing them in the database.
Recently, data leaks and supply-chain attacks have been on everyone’s radar, so we decided not to leave FCM tokens “as is.” In PDP Mobile, we introduced symmetric encryption for tokens before storing them in the database.
Why does this matter at all? If the database is ever compromised, an attacker won’t be able to launch a mass push campaign to residents of a housing complex. And that’s not just a bug anymore, but a very unpleasant scenario in the “why did I get 500 notifications at night?” category.
To make sure the protection exists in practice, not just on paper, we built a security chain:
FCM token → encryption → database
Everything is fine on the device side too: we use encrypted MMKV storage plus Secure Keychain/Keystore for secure key handling.
The result: even if something leaks somewhere along the way, the data doesn’t turn into a ready-made attack tool. Security is no longer a nice-to-have; it’s the foundation.