googleprojectzero.blogspot.com, security.googleblog.com, cloud.google.com/blog/topics/threat-intelligence, bughunters.google.com/blog, blog.google/technology/safety-security
Shouldn't they be blogging the org chart? When I want to follow updates, it's generally from a particular part of the org. Each group has its own separate mission and its own audience.
That makes as much sense as saying every Y Combinator startup should post on a single shared blog, with tags to filter by company.
No -- a single blog should revolve around a single group of authors writing around a single, concrete theme -- an individual product, product suite, initiative, or similar.
The idea of a single blog with 500 posts a day from 500 different people sounds terrifying, tags or not. It's too many tags -- like, you'd need tags for the tags!
You'd never in a million years want content like this mixed in with that:
As such, you should never use them to protect data that needs to stay secret indefinitely (or for a long time), such as keys.
Apps and websites get copied all the time. Somebody throws up a duplicate with ads and steals your traffic and search rankings and customers and whatever.
Adding code to prevent your product from working when it's not on the right app/domain, and obfuscating your code to obfuscate those checks, can be sadly necessary. It doesn't need to defeat a determined attacker, but just be hard enough they'll spend their time cloning something else instead.
I speak from experience...
Unless you want your app to be used anonymously, but then why have secrets?
So the app used a digital signature / request signing with a key that was obfuscated and embedded in the binary. With anonymous users I don't know how else you could avoid use of the private API.