Looks like the Google API client ID and client secret are stored in clear text shipped with the released app:<p><pre><code>  WMail.app&#x2F;Contents&#x2F;Resources&#x2F;app&#x2F;bin&#x2F;shared&#x2F;credentials.js
</code></pre>
, and this seems to be used in authentication with Google: <a href="https:&#x2F;&#x2F;github.com&#x2F;Thomas101&#x2F;wmail&#x2F;blob&#x2F;master&#x2F;src&#x2F;main&#x2F;AuthGoogle.js#L61" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Thomas101&#x2F;wmail&#x2F;blob&#x2F;master&#x2F;src&#x2F;main&#x2F;Auth...</a>