Keys are read from BuildConfig fields populated via local.properties (git-ignored) or CI environment variables, never embedded in source files or strings.xml. Encrypted local storage.