We're trying to implement AssetBundles in our current Unity project for Android and iOS.
My question is about security. To download AssetBundles, our application need to connect to our server. On our server, we got a web service that returns the download link for the bundle needed by the application.
However, the ID and password to connect to our web service are written in plain text in our application. This may sounds as extremely naive, but is this an issue? Could someone find the ID and password from say, the .apk file?
I don't have a lot of knowledge in the field of servers and network security, so I'm trying to keep up with what our team is doing.