Today's script
I embedded a key in an app and compiled it. I read the key back in 10 seconds. Most people think this way: the code is compiled, so nobody can see inside anymore. A compiled file still carries the text as is. The strings command pulls it out in one line. And now AI reads it too. In October, a game developer wrote that AI is decompiling old games in bulk. A Linux developer also used Claude to reverse-engineer a film scanner's driver in a few days. The first item on the OWASP Mobile Top 10 is exactly this: hardcoded credentials. So in a mobile app, a game or a frontend, every key can be read. The fix: keep the secret on the server. The app should only send requests to its own backend. If the key is already in the app, revoke it first. Put the new one only on the server. Try it yourself: run strings on your compiled file and search for the first letters of your key. Give this prompt to your assistant and save the video. Tomorrow: a PC download link for GTA 6 showed up. Is it real?
