Extracting hardcoded Nobi secret

I think we have a security issue, please review. 

I understand that having Nobi secret hardcoded allows an attacker to reset the password of anyone just knowing their ID.