App stores client secret unencrypted in database