Udaysinh Sapate
← Writing

06 Oct 2026 · 2 min read · — reads

boAt left the keys in the app

securityandroidreverse engineeringboatoauthtinkering

Reading

Size

Quick follow-up to the boAt smartwatch post. While digging through the boAt Crest app, i found something that made me laugh out loud, alone, at night, at a decompiler: boAt left the keys in the app, and they put a label on them.

tl;dr

  1. A client secret (a password that's supposed to stay on a server) ships inside the app.
  2. Anyone can read it by unzipping the app and looking.
  3. It still works.
  4. It isn't dangerous for users. It's just funny.

how i found it

An Android app is a zip wearing a fake moustache. Unzip it, run it through jadx, and you can read the code.

Charlie from It's Always Sunny in Philadelphia frantically pointing at a wall of papers and red string labelled Pepe Silvia.
me, three hours into decompiled watch code

On the way to the watch code i passed BuildConfig, the junk drawer of every Android app, and there in plain text were the keys for Mappls (MapMyIndia, boAt's maps provider):

MAPPLS_MAP_ATLAS_CLIENT_ID     = 96dH…   (fine, meant to be public)
MAPPLS_MAP_ATLAS_CLIENT_SECRET = lrFx…   (this one, uh, is not)
MAPPLS_MAP_REST_API_KEY        = ce37…

(values clipped on purpose.)

They named it CLIENT_SECRET, in all caps, which makes it a diary with "do not read" on the cover, left open on the kitchen table.

it was real

I sent one request with those two values, basically "hi, i'm boAt, trust me." The server said 200 OK and handed over a token good for about a day.

An old dog calmly closing its eyes in warm sunset light, accepting its fate.
that secret, the moment the server said 200 OK

I stopped there. I didn't call any map APIs or touch anyone's data, i just wanted to know if it worked.

how bad is it

not bad. No user data leaks. Worst case, someone burns boAt's maps quota on their tab.

What makes it funny is who it is. This is the brand on every cricket broadcast, and its slogan is "plug into nirvana". Turns out you can also plug into their maps account. So the boat isn't sinking, it just has one small leak with a sticker on it that says LEAK.

for the record

This mistake hides in loads of apps. I told boAt privately before writing this, and this post is deliberately useless as a how-to.

Also, this isn't the only thing i found in there. There's more, and some of it is just as funny, but legally i can't talk about it, so you'll have to imagine. (boAt, my inbox is open.)

Share on XLinkedIn
← All writing