Storing .well-known/assetlinks.json in public repo?

Question

Is it safe to store the file .well-known/assetlinks.json in a public repo? Since the statement list asks for a signing key, it seems like this is a sensitive file?

Answer 1

Google's official generator does not ask for a signing key, just the fingerprint of the associated app. If some tool is asking for the signing key you might have encountered a phishing attempt.