<s>[INST] ### Security through Obscurity 
#### Day 12's code left off at the point where an attacker would need to manually inject code.
#### Current Security
- NL bits can't be served as any object's property through jsx. 
    - This is setup using the `NO_HOIST` object and the set `_instanceKey` on it, 
        this only works while not inside an xss attack box.-( xss Attacker can provide a string)
#### How to Protect against code injection
- Can we make `instanceKey` even more inaccessible to protect against more sophisticated attacks?[/INST]