Security problems for google app engine webservices

Question

I've write a google web-services based on java to encrypt and decrypt messages, just wondering if I deploy this project to app engine, how can I make sure my java classes are safely at the server side? Because there are secret keys inside code.
Do I need add some identification steps before can use the web-services?

Answer 1

It's as secure as any other hosted service - trusted people (Google admins) have access to servers and your compiled code. If you are not OK with that, you should run your own servers.

You may want to disable code download , in case your google account gets compromised.

Also, access to your Google account is an attack vector to get to AppEngine admin access, so make sure anybody with developer access to your GAE app has two-step authentication enabled .