I currently have a project which I'm planning in the not too distant future to open source on GitHub.
The question I have is regarding how open source projects are released if they have encryption keys.
Basically, the project consists of an Android app (not being open sourced) and a PHP API.
The PHP API can potentially send/receive confidential information such as authentication details. Obviously, the API should be run under HTTPS to offer some security, but on top of that, the Android app, will encrypt all the data, then once encrypted and it sends the request to the PHP API. The PHP API decrypts the request and then generates a response, which is then encrypted and the response is sent back to the Android app to decrypt and process.
The encryption between the Android app and the PHP API has a hard coded encryption key (I'm using 256 AES encryption). It doesn't seem right that this key is kept in the open source code as then if someone managed to find a way to do a man in the middle attack between the app and the API, they have the key, potentially exposing the user authentication details.
What's the recommended way for doing this? Should I just not offer encryption, and just rely on the user using HTTPS, and if they don't, it's their problem or is there an alternative method I could use?