I am doing a research on an app which has some secret ID. I see that the source code of the app has the secret ID hardcoded inside and the API to request for the access token has just this Secret ID as its query parameter. So ideally it is possible to call this API from literally anywhere (I tried even with Postman). And I was successful to get the access token - it was valid for 2 hours. I can regenerate it as many times as I want since I have the Secret ID with me.
So they had a public documentation of their APIs in which they have mentioned that Secret ID is not to be stored anywhere in the dev environment as plain text for security purposes (However the developers themselves did not follow it). And there were a lot of other APIs requests which required only for this access token as its query string parameters - but most of them seem not so critical information (or at least I feel so). One of them was how many users visited their app, how many new and how many retained, etc.
I would like to report the vendor app about these but I would need a valid proof of concept to exploit this. There is also a chance where they might ignore my report saying that there are no critical information that can be fetched/modified using this leaking access token (which contradicts with their documentation, but still)
So in general, I am confused about this. Should access tokens and the app secret always remain a secret only no matter what or does it depend on the information that can be obtained using these secrets? To which should more priority be given?