I am developing a native app that needs to access protected resources using OAuth 2. There is a business requirement so that a user has to enter his credentials manually as rarely as possible and the best way to achieve that is to use an authentication flow with a refresh token. Retrieving refresh tokens requires a client secret which by OAuth design should not be stored in a native app.
I know there are flows that don't use client secret e.g. with public clients, but I wasn't able to implement them within the technology stack I use.
My question is: how bad is it to still use client secret in an app if refresh token is well secured and there is a small chance of it being leaked? For attacker knowing the secret doesn't achieve much in this case, does it?