ABDULHAMEED IDRIS ADEDAMOLA

May 03, 2026

🚨 How to Prevent Leaking Your Android Keystore (.jks) on GitHub

One common but dangerous mistake Android developers make is accidentally committing their keystore (.jks) file to Git. This can expose your app signing key and compromise your app on the Play Store.

🔍 The Problem

Even if you delete a .jks file from your project, Git may still be tracking it. That means it can still be pushed to GitHub — which is a serious security risk.

✅ Step 1: Add .jks to .gitignore

Open your .gitignore file (in the root of your project) and add:

*.jks

This tells Git to ignore all keystore files in your project.

⚠️ Step 2: Remove Already Tracked Files

Important: .gitignore does NOT remove files that Git is already tracking. You must remove them manually.

git rm --cached upload-key.jks
git rm --cached app/upload-key.jks

This removes the files from Git tracking but keeps them on your local machine.

🔎 Step 3: Verify It Works

Check if Git is still tracking any .jks files:

git ls-files | findstr jks

If nothing shows, you're safe ✅

Also confirm ignore rules:

git check-ignore -v upload-key.jks

💡 Key Takeaway

.gitignore only works for future files
Tracked files must be manually removed
Always verify before pushing to GitHub

🔐 Bonus: Recommended .gitignore Entries

# Keystore files
*.jks
*.keystore

# Signing configs
key.properties

# Local config
local.properties

🚀 Final Thoughts

Securing your keystore is critical for protecting your Android app. A small mistake in Git can lead to exposing sensitive credentials publicly.

Always double-check your .gitignore and Git tracking before pushing your code.

Stay safe and build securely 🔐

Search This Blog