I think he's talking about application wide (not user specific) "secrets" in the javascript layer.