can Build Types resources be visible while reverse engineering the app?

Question

I have two build variant in my Application, one is release and other is debug.

In a release, I have set my https URL. In Debug, I have set my local URL for testing purpose.

is it possible if I upload my release variant to PlayStore that somebody can reverse engineered it and see my Local testing URL? I dont want to expose my testing URL?

Answer 1

If you just use flag to switch running environment and sorce code contain the local testing URL, it'll able to find in the disassembled smali files even if you obfuscated it

You can try to split building const from resource using gradle, ref here: Change constant values when building a release edition