That's not how API keys work; scramble them and they're different. What I gathered is that the authors didn't look for glaringly obvious things like variable names, but did a more generic scan for strings or keys that look like encryption keys. Obfuscation won't help there. I don't know if it's possible to encrypt your entire codebase and still end up with a workable app - after all, the decryption would still need to be done on a potentially unsafe device.

Obviously a scrambled key wouldn't work if you try to use it subsequently in it's scrambled from. But you can store the these keys in a safer way. There are numerous ways you can obfuscate the key. For instance, convert the key to binary and store it 1 bit at a time, every 8 bits, in a bitmap log. Or think of something more elegant. Write the accessor function that pulls the key on the fly and returns a string. I know, you can still read the key our of memory, but all of the sudden you need to do a lot more work to pull it.

Also, scrambling function and variable names is always a good idea, it makes reverse engineering your app a lot harder. And there are many programs on the market that will do this for you automatically.

That doesn't really help either, though. At runtime, the data will have to exist in memory at some point.

security through obscurity, not a good idea.

Why not. Is security through obscurity better than nothing at all?