Hide Apps Script code from editor of a Google Sheet - google-apps-script

Question

I hope I'm not again asking a question that's been answered, kindly bear with me if I am doing so.
I basically have been building a Google Sheet to be used by a number of users. I created a number of Script files and everything is working as expected, however editors of the Sheet will be able to see the source code from Script Editor menu option on Sheets.
There is a lot of sensitive information in the scripts that should be hidden from the editing users, how can I restrict them from editing the scripts and also not viewing sensitive information?
I found this answer which suggested publishing the Apps Script project as an Add-on. Unfortunately I am having a tough time comprehending how to go about it (my manifest hasn't been updated) and there are a few more answers that use different approaches.
Note: If there is an easy example showing how to go about Publishing then kindly share as I am struggling with Google's documentation.
My appsscript.json file:
{
"timeZone": "Africa/Maputo",
"dependencies": {
},
"exceptionLogging": "STACKDRIVER",
"runtimeVersion": "V8"
}
Note2: The scripts' entry point is via an installable trigger On editing the spreadsheet
Note3: When switching to Legacy mode and Publish->Deploy from Manifest as in the examples from Google's documentation, I cannot see an option to install the addon - No entry points is indicated.
What would be the best way to achieve this security feature given I have multiple .gs files in my project and want the editors of the Spreadsheet not to have even viewing access of the source code.
Will greatly appreciate any feedback, Thanks.

Answer 1

The behavior you are experiencing seems to be due to the fact that the script is bound to the sheet in question.
A bound script is nothing but a script which was directly created from the spreadsheet itself rather than separately.
What you can do in this situation
Create a new Apps Script project which is not bound to any spreadsheet. A simple script.new in the browser bar will do the trick.
Copy and paste the entire code to the new script.
Replace any instructions similar to:
SpreadsheetApp.getActiveSpreadsheet().getActiveSheet();
// Or whichever Apps Script service you are using
To:
SpreadsheetApp.openById("SPREADSHEET_ID").getActiveSheet();
// Or whichever Apps Script service you are using
Since the new script won't be attached to the spreadsheet, you will have to specify exactly which spreadsheet you want to open and work on, hence the use of openById method.
Reinstall the trigger/s
You can install the triggers programmatically too! For your use-case, if you want to use an onEdit, just create the following function. This ends up creating an onEdit trigger and it attaches it to the function you want it to act as the trigger.
function createSpreadsheetEditTrigger() {
var ss = SpreadsheetApp.openById('SPREADSHEET_ID');
ScriptApp.newTrigger('TRIGGER_FUNCTION_NAME')
.forSpreadsheet(ss)
.onEdit()
.create();
}
Remove any code from the old script which was attached to the spreadsheet.
Voilà!
Reference
Container-bound Scripts.

Answer 2

Each Editor has access to all shared codes.
Check this website
To hide code for editors, you can only obfuscate the code.

Answer 3

You cannot protect the code nor any credentials unless you publish the code as an add-on.