Security researchers are raising the alarm about mobile app developers relying on insecure practices that expose Amazon Web Services (AWS) credentials, making the supply chain vulnerable.

Alas, none had done it -- until yesterday, when Amazon announced their AWS SDK for JavaScript in the Browser. Theoretically, it does for their web services, what Dropbox did for theirs.

Exclusive A massive online heist targeting AWS customers during which digital crooks abused misconfigurations in public websites and stole source code, thousands of credentials, and other secrets ...

Hundreds of mobile apps have been found to be leaking Amazon Web Services (AWS) credentials. A recent Symantec analysis identified 1,859 publicly available apps, 98% of which are iOS apps ...

The SDK supports Amazon’s web identity federation feature (you wouldn’t want to add your AWS credentials in your HTML and JavaScript, after all).

The information pulled this way included AWS customer keys and secrets, database credentials, Git credentials and source code, SMTP credentials (for email sending), API keys for services like ...