IKs there a good simple way to keep it secret? I assume someone could have a look at the JavaScript on the browser and see hey this must be the secret stored h

IKs there a good simple way to keep it secret? I assume someone could have a look at the JavaScript on the browser and see hey this must be the secret stored here because it is passed to the server on every request. Then write there XSS attack to use that.