Since script params are compiled into the validator, this means that if you have the script cbor you can see what the param value is, right? Hence they would not be suitable to store data you don't want available on chain?
The reason I'm asking is because I had a look at the lobster challenge (https://github.com/input-output-hk/lobster-challenge) posted by iohk a while back and they mentioned that they used a script parameter to add their "secret random" number when the contract was compiled, which would be used to offset the final value.
My intuition says if you had access to the script cbor(which you can get from blockfrost now) you would have been able to find out what their number was and if you were the last voter, have your pick of the name? Them using this method made me question whether having the cbor is enough - I'm not familiar with what's involved in decompiling plutus core cbor. Thanks.
As you can imagine I'm not too fussed about whether the lobster naming was exploitable, more curious for the sake of learning.