I have a python script which writes data into a public google sheets file and for using the google sheets API I need to have a user authorize my script. I want to share the script with others and thus I'm considering sharing the client_secret.json as well, but I'm struggling at understanding the security-risks involved in this.
As far as I understand OAuth2, by providing client_secret.json my script authenticates itself and then a user authorizes the script to write data on the user's behalf, right?
Thus, am I correct, that the worst thing which could happen when I would share the client_secret.json, is that someone would exploit my service to write data into sheets (only his/her own or into public ones) by using my script's quota?