As a core part of app security, protect your app project file and be diligent when you export or import apps and their components.
An app project file contains information about how an app is constructed and who has permission to edit the app and access its data. When you create an app, App Maker creates the app project file in your Google Drive and assigns you as the owner. You can share the app project and transfer ownership as you would any other Drive file.
An app package is a zip file that you export from App Maker. The app package can contain an entire app or selected components (also called a module). When you share an app package, the recipient can import the file and create their own instance. The app package doesn't include any app data, but your scripts, models, pages, and roles are all available.
Manage app project file ownership
Initially, the app project file owner is the person who creates the project. Project owners are powerful. A project owner has full control over the app project and app deployments. As a project admin, they can also import and export data in all deployments of the app, no matter what the security settings are.
To change app project file ownership:
- The owner of an app project file can transfer ownership of the app project file, as they would any other Drive file.
- A G Suite administrator can transfer ownership.
Control access to app project files
An app owner can share app project filess with specific users (Google Accounts) and groups (Google Groups) in the same way you share files in Drive, Docs, and Sheets. You can share a project with the following access levels:
- Can edit—Users with Can edit access can modify the app and publish app deployments. They also have full access to all data in any deployments they own.
- Can view—Users with Can view access can open the app in App Maker and read all scripts and pages. They can't preview apps, publish app deployments, or export data from deployments.
Don't share your app project file with someone unless you trust that person. In particular, an app editor can change:
- the app UI
- permissions
- scripts
- data access permissions
Use the following table to determine the appropriate permissions for your users and groups:
| Action | Project owner | Edit permission | View permission |
|---|---|---|---|
| View a list of deployments | |||
| Publish a deployment | |||
| Edit a deployment | if deployment owner | if deployment owner | |
| Republish a deployment | if deployment owner | if deployment owner | |
| Delete a deployment | if deployment owner | ||
| Import data to a deployment | if deployment owner | if deployment owner | |
| Export deployment data | if deployment owner | if deployment owner |
Create and share app packages
You can export an app into an app package. App packages can be shared and imported. An app package is a complete record of how an app is constructed. It contains:
- data models
- the user interface
- scripts
- information about roles (but not the membership of the roles, which is defined in deployments)
- the instance name, if the app uses a custom Cloud SQL database
It doesn't contain app data, information about deployments, or revision history.
An app package doesn't present as many possible security concerns as a shared app project file. When a developer imports an app package, they add app components that are visually and functionally identical to the original app. However, the imported app package isn't connected to the original database and no users are assigned to access control roles.
Best practices for app project security
- Consider who should own the project file before you start development.
- Restrict access to app project files based on developer and user access requirements.
- Only share app project files and app packages with people you trust.
- Share an app package instead of the app project file when the recipient needs access only to app components and not to deployment data.
- Only import app packages from people you trust.
- Make sure you understand what you import. App packages define some aspects of app security and data access.