> assume that every string in the code will inevitably be seen by a real user/customer.

That's a good rule, and the same principle can be applied to communications in general. In fact, I have the three rules printed on my office door:

    Dance like nobody's watching
    Encrypt like everybody is
    Email as if it were read out loud at a deposition