PDK application are compiled C++, so you only have object code. Most of the apps HP ships on device are JS apps, so source is there. A developer can choose to only ship minified/obfuscated source code if they want, but there still has to be something for V8 to parse and execute.
Right, I understand that but what I'm getting at is: if I create an application that is purely JS/HTML/CSS based, will my source be available to other developers that put their phone into "developer mode"?
If so, is there any way to make it not publicly available?
No, there's no way to completely hide the source. However, we do have a key manager API that can be used to hide encryption keys so they're not exposed in your source.