Why? You can protect the code in the microcontroller but not with a passowrd. Check the datasheet of the 32U4 microcontroller.
Have a look at Robin's Serial Input Basics - updated. That's the Arduino receive side of things. You can test that with Serial and once you're satisfied that it works 100% switch to Serial1 which would be used for the Bluetooth and write the phone app (or use an existing one).