When we provide gitlab API key & secret in xcode cloud using an appstoreconnect account, will other appstoreconnect user be able to access that source code using that key/secret info?

If we use hardcoded build number for app store receipt validation then how can we manage xcode cloud auto build number to be replaced in the code?