Yes yes I know I have the client secret for oauth in there. I disabled granting tokens though so you shouldn't be able to use it regardless unless you have a pre-existing refresh token, so all should be well :)