How would I be able to put Google Maps API key in .env file and reference it from app.json? If not possible, how do people currently go about hiding ios.config.googleMapsApiKey and android.config.googleMaps.apiKey from source control?
The key is public. You lock it in the Google Cloud console by specifying which domains are allowed or whitelisted, That way its only valid from your site. You can also add localhost:5555 for testing purposes