ios - Bluemix Push service security concern -

we using ibm push-notification service , mobile-app-security on our bluemix app (serving ios clients).

in order send push notification, our server sends post request to: https://mobile.ng.bluemix.net/push/v1/apps/{application-id}/messages

with application secret in ibm-application-secret header (following instructions here).

to initialize mobile-app-security sdk inside our app need both application-id , application-secret - means app must contain these values (as constant parameters or download server). if malicious user fetches these values using simple reverse-engineering, able send same post requests, i.e. send push notifications other clients, right?

shouldn't there 2 application-secrets? 1 secret app (making hard fake registrations - i.e. require reverse-engineering) , 1 server (which allows send notifications , should never stored on client-side).

is possible initialize mobile-app-security ios sdk without application secret?

i understand concern. address questions:
-you must have app secret on client side in order authenticate mas , use push service (push relies on mas auth)
-we recommend implementing own form of security prevent malicious user obtaining app secret. example, encrypting file stores app secret, or app secret itself.

if looking more robust built-in level of security, recommend using newer mobilefirst services starter, support push , advanced mobile access service (ama), available ios 8.