Well, yes, but you didn't anonymize the name of the app, so it's easy to download it and extract the credentials.