never touched the security code till now. now i wanted to activate it and apparently it's already set to something. is there a default code?

default code is empty string, so there is no default code.

Default is empty (not set at all) as rainisto said.

Did you configure MfEaccount? Or iirc also Track&Protect?
Search with that (security code mfe) in tmo and you will find some examples...

if you using custom kernel you can't activate security code.

Yes.
But he claims he already has one set.
--edit
Sorry, just rethought. Your answer is absolutely correct and feasible,
coderus!

btw.
what about a security code that has been set before flashing open kernel? Will that stay in CAL or is it not possible to flash open kernel in that case? (I think I know the answer, bit want to be sure!)

Lets post couple more corrections:

1. You can activete security code with custom kernel, but you need a custom devicelockd for it.

2. You can recover & read devicelock code in cleartext if
a) you have setup trusted person
or
b) use exploited capabilities and custom devicelockd for reading it from aegis secure storage.

so basically this all started with Track & Protect app. after signing up and activating an account i tried the security code on my phone and it doesn't work. tried to sign in to my account on the website and they don't even recognize my phone number which is very strange because it was originally verified with an SMS when i signed up. i emailed them but got no answer. so what can i do?

If you used track&protect app without 1st seteting the lock code, then the code most likely is some random string. Only way to recover and setting the code back to default is to reflash with --erase-user-data=secure, that will reset the lockcode back to default.

@rainisto is devicelockd under Request Code license? or it should be hacked?

Orly?
Who designed/programmed that?

Serious question:
Is it possible to remove Dreck&Protest from firmware/system?
As it is of no use at all.