add note warning against hard-coding app creds into app source