“In my excitement to get 2.0 into production, I was a little sloppy, placing the password in User Defaults.”
Aviator was broken from early December because OpenSky Network went down. One free data source fails and the whole app dies. Then the API password went into User Defaults, a plain plist that any device backup exposes. Hobby apps ship the same mistakes as enterprise apps, just with fewer lawyers.