With the Union Platform, the administrator password is stored in an XML file. I know I could just rename the file and tell the swf to read it from that new location, but if someone were to decompile it, not only would they get the source like normal but they would then be granted administrator access. I know I could try changing the admin SWF file name or the port that the Union server is running on, but this is a really insecure method.
Since the admin swf is a free download on their site, anyone with access to the internet could hack my program if they found my XML file.
Since the Union platform is probably a bit obscure, here is the website.
I would just password protect the directory the xml file is in, but that would not do too much good as flash files do not know how to enter passwords.
The config XML file you’re talking about doesn’t go anywhere near your web contents. It goes in the UNION_HOME folder, which is wherever you unpack the app for installation. See this page for more info.
Thus, SWFs don’t access that config file to check passwords. SWFs connect to the server with a socket connection, and the server app knows how to check the XML file. There’s no security issue.