I’m building an APP that accept external requests from web 2.0 that needs to be verified, if I use some secret in a variable using Rust, after compile someone can revert the data and get the secret in some way? In other works it is safe keeping secrets in a canister?

Nodes can see the code they are running, and by design nodes are meant to be run by untrusted third-parties. So no. Ingress messages can be verified by the user principal system; the threshold ECDSA signing feature will enable the secure secret signing of data going the other way.

It is safe to keep secrets in a canister?

Developers Getting Started

jzxchiang July 12, 2022, 6:21am 7

This is part of the long-term roadmap, but I don’t know if there have been any updates on this front.

Topic		Replies	Views
Threshold Key Derivation - Privacy on the IC Roadmap Discussing , privacy	203	16307	April 8, 2025
Environment variables security on a frontend casniter Developers Frontend	20	117	November 29, 2024
Is the canister data / state secret or public? Developers	3	1103	November 25, 2022
Are there any plans to implement threshold RSA similar to ECDSA? Developers Discussing	5	392	March 3, 2024
Can threshold ECDSA signatures be used maliciously by rogue node operators? General	5	346	May 1, 2023

It is safe to keep secrets in a canister?

Related topics