I've built an android app that is only ever going to be used by me. It's not deployed to the store or anything - I download it to my phone with HockeyApp.
However, this app has an oAuth token hardcoded in as a string, which can access my private repositories on Github. Is this a security risk? I really don't want to go about the whole process of implementing an oAuth flow to generate a token via some kind of sign-in, so I'd like to just leave it hardcoded.
I'm not exactly the CEO of Google, so it is incredibly unlikely that anyone will make a malicious attempt to steal such things from my phone, though I suppose the possibility does exist.