# It's not closed source

> I embedded a key in an app and compiled it. I read the key back in 10 seconds.

URL: https://iamcanturk.dev/en/shorts/kapali-kaynak-degil/
Pixel Shorts #11 · October 25, 2026 · for developers

---

**In short:** A compiled app still carries any embedded key as plain text; the strings command pulls it out in one line, and it's the first item in the OWASP Mobile Top 10. Keep secrets on the server and have the app call only your own backend; if a key already shipped, revoke it first.

Most people think this way: the code is compiled, so nobody can see inside anymore.


## What's in the video?
I embedded a key in an app and compiled it. I read the key back in 10 seconds. Most people think this way: the code is compiled, so nobody can see inside anymore. A compiled file still carries the text as is. The strings command pulls it out in one line. And now AI reads it too. In October, a game developer wrote that AI is decompiling old games in bulk. A Linux developer also used Claude to reverse-engineer a film scanner's driver in a few days. The first item on the OWASP Mobile Top 10 is exactly this: hardcoded credentials. So in a mobile app, a game or a frontend, every key can be read. The fix: keep the secret on the server. The app should only send requests to its own backend. If the key is already in the app, revoke it first. Put the new one only on the server. Try it yourself: run strings on your compiled file and search for the first letters of your key. Give this prompt to your assistant and save the video. Tomorrow: a PC download link for GTA 6 showed up. Is it real?

## Check your own project
- [ ] Mobile app: readable
- [ ] Game: readable
- [ ] Frontend JS: readable
- [ ] Server: not readable