Also, my project is open-source. However, not everybody wishes to check how the app's backend works. Plus, there are things like CI/CD, which is a hidden part,

Also, my project is open-source. However, not everybody wishes to check how the app's backend works. Plus, there are things like CI/CD, which is a hidden part, so I can potentially modify code and steal tokens on that side, meaning that open-sourcing is not the solution.