So, how can other apps using Parse prevent from leaking keys?

You can't. Putting keys in a distributed app means it can be reversed somehow and leaked.

I think the atom.zip is being updated continuously. Today I finally got my invitation and it gives a different shasum too. File diff shows the Info.plist of my newly downloaded version as of 2014-03-07 is:

    <key>CFBundleShortVersionString</key>
    <string>0.69.0</string>