Nothing inside an app is secret

Your code gets scrambled on the way to the phone. Scrambled is not secret. Here's what that means for Day 17, when you first need a password.

Your app gets packed into one file and sent to the phone. That file is basically a zip, and anyone who has your app has it. Your code gets scrambled on the way in, which makes it hard to read. It does not make it impossible to read. People unscramble it for fun, and there are tools that do it in a minute.

What this changes

Today it changes nothing. Tally has nothing to hide. A counter has no password.

On Day 17 you will want to talk to a service that needs a key, and your instinct will be to put the key in the app, because that's where the code is. Don't. If it ships to a phone, treat it as public.

What you do instead

The key lives on a server you control, and the app asks that server to do the thing. The server checks the request, uses the key, and sends back the answer. The app never sees the key. The Kit's secrets helper is for values that are secret to the user, like their own sign-in token, not for values that are secret from the user.