[Kiro]

Even if it's not passed in the request it's still in the app so isn't it vulnerable to reverse-engineering?

[misterjangles]

There shouldn't be a key baked into the app. Each user gets their own unique key. so the worst you could do reverse engineering the app is to steal your own key. There should never be any "master" key used for all users.