Is it considered safe to leave your oauth ID and Secret public in open source projects?