For a small apps there's nothing checking against intentional malicious activity. Sure it'd be there in plain sight, but it's pretty unlikely really that anyone would read the source code of some random single person project.