Security around the rotation of public app client secret

Thanks @nickdeckerdevs1 :raising_hands: